Hello Henrik, Now tproxy works but http://devel.squid-cache.org/cgi-bin/test shows source address of connection as ip of my squid not my test client computer behind router A. On squid i have: w3cache ~ # dmesg | grep TPROXY NF_TPROXY: Transparent proxy support initialized, version 4.1.0 NF_TPROXY: Copyright (c) 2006-2007 BalaBit IT Ltd. w3cache ~ # ip rule 0: from all lookup local 32764: from all fwmark 0x2 lookup 100 32766: from all lookup main 32767: from all lookup default w3cache ~ # ip route show table 100 local default dev lo scope host w3cache ~ # iptables -n -t mangle -L PREROUTING Chain PREROUTING (policy ACCEPT) target prot opt source destination TPROXY tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 TPROXY redirect 0.0.0.0:3128 mark 0x2/0x2 DIVERT tcp -- 0.0.0.0/0 0.0.0.0/0 socket Squid with http_port 3128 transparent tproxy On router 0 and routers A,B... config from your post. Mayby this version of tproxy doesn't correct work? Dnia Pn Marca 31 2008, 18:40, Henrik Nordstrom napisał(a): > mĂĽn 2008-03-31 klockan 15:10 +0200 skrev admin@xxxxxx: >> Are You sure that router should mark packets on inside interface? and >> restore at outside interface? > > Yes. It marks outgoing connections, and routes the incoming response > packets based on that. > >> That configuration isn't work for me. When i connect webserwer for >> switch >> (like Router a,b,c..) in squid logs i see that packets flows by squid. >> But traffic from outside my net don't want flow by squid. I suppose that >> on Router0 i have error. > > Have you set up the needed policy route routing mark 1 packets to the > Squid server? > > Also remember to enable IP forwarding on the Squid server, and make sure > it knows to route the client networks directly to respective client > router... > > Regards > Henrik > > -- Tomasz Kolaj Administrator sieci ABP Computer
