also since this is a bridge .. dose the bridge hold the ip .. or the actual physical interface? and what interface do you have squid bound to .. In this case I would not try binding squid to 0.0.0.0 .. that might make squid bind to both the bridge and the eth interface .. which would make things interesting -----Original Message----- From: Madhav V Diwan <mdiwan@xxxxxxxxxxxxxxxxxxx> To: Peter Warasin <peter@xxxxxxxxxx> Cc: Amos Jeffries <squid3@xxxxxxxxxxxxx>, squid-users@xxxxxxxxxxxxxxx Subject: Re: TPROXY does not redirect to squid port Date: Tue, 28 Jan 2014 11:04:12 -0500 to clarify: your squid conf and your tproxy iptables rules work when you set up squid on port 80 They also work when you bid squid to port 8080 .. But you dont want to bind squid to port 80 because you want apache there ... sounds like you need to find out why you cant bind to port 18080.. or at least whats keeping you from having squid bind there. try netstat -tulnp as root to see what ports are bound to processes and the PIDs and try lsof and grep for 18080 worst comes to worst .. stop trying to bind to 18080 and use another port , like 9090.. tproxy does not care what port squid is on as long as it is listening on the port you specify as the destination. -----Original Message----- To: Madhav V Diwan <mdiwan@xxxxxxxxxxxxxxxxxxx>, Amos Jeffries <squid3@xxxxxxxxxxxxx> Date: Tue, 28 Jan 2014 16:05:25 +0100 hi guys On 01/28/2014 02:30 PM, Madhav V Diwan wrote: > Have you made certain that squid in the squid configuration file > ( /etc/squid/squid.conf) is listening on port 80 ( the destination port > in your iptables rules) port 80? squid is listening on port 18080, where the tproxy rule "redirects" to: http_port 0.0.0.0:8080 http_port 0.0.0.0:18080 tproxy just tried to make it listen on port 80 (with no apache running there) and changing the tproxy rule in order to redirect to port 80. then it works. but i need port 80 for apache. also i need to redirct port 443 as well later, when this works. > and have you checked tcpwrappers , or selinux? sure. nothing enabled. also it works when i remove the tproxy rule and use normal bridge forwarding and it works also when i use squid directly on port 8080. so squid config should be ok and uplink, routing, forwarding, firewalling all should be ok. seems really that the kernel actually finds the squid socket, assigns it to the packet, but the listening process does not get it, either squid nor tproxy_example tool. i was thinking maybe glibc is to old, but i guess IP_TRANSPARENT is only a kernel headers thing and there was no change in glibc for it, right? peter
