LinuxQuestions.org
Support LQ: Use code LQCO20 and save 20% on CrossOver Office
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
LinkBack Search this Thread
Old 09-07-2009, 02:00 PM   #1
redss
Member
 
Registered: Jun 2003
Posts: 147

Rep: Reputation: 16
Iptables question


Say for example I turn off the squid proxy that usually accepts requests on port 3128 of my server.

Is there an iptables command that will simply forward all packets to their destination in the absence of squid running?
 
Old 09-07-2009, 03:11 PM   #2
clvic
Member
 
Registered: Feb 2008
Location: Rome, Italy
Distribution: OpenSuSE 11.x, vectorlinux, slax, Sabayon
Posts: 206
Blog Entries: 2

Rep: Reputation: 44
I don't think so. SQUID is specially made to act as a proxy - that is, it will examine messages (network packets) at application level, look inside them, and then decide. That is, the browser (if it's a browser) that contacts squid, contacts it directly and then tells it to forward a request.
iptables is mainly made to act at a lower level. So, if you try to contact SQUID and it's not there to answer, you won't know where the request was directed.
I don't know if this is clear enough - it also depends on how much you know TCP/IP networking.
 
Old 09-07-2009, 03:43 PM   #3
redss
Member
 
Registered: Jun 2003
Posts: 147

Original Poster
Rep: Reputation: 16
I don't understand why any intelligent decisions need to be made, since at a low level the packets just need to continue to go on their merry way.

Ok put a different way - say for example I do arp spoofing to turn my linux box into a gateway for a windows pc on the LAN. If ip forwarding (/proc/sys/net/ipv4/ip_forward) is on, then the windows box will continue to operate without DOS. If I reroute with the following command:
iptables -t nat -A PREROUTING -i eth0 -p tcp --destination-port 80 -j REDIRECT --to-port 8080

Then is there another iptables command that will forward the packets without requiring a proxy to handle the traffic on port 8080?
 
Old 09-08-2009, 01:00 PM   #4
rjlee
Senior Member
 
Registered: Jul 2004
Distribution: Ubuntu 7.04
Posts: 1,989

Rep: Reputation: 63
I'm not sure of the iptables details, but I can at least answer your second question:

There is no general solution to this, since the way an HTTP proxy works is 1) the web browser establishes a connection to the proxy server, then 2) it sends the URL for the requested webpage.

You can't use NAT to establish a connection, only to do lower-level packet filtering where the SYN and ACK packets are passed back and forth between the client and destination, so you can only achieve 1) by forwarding the SYN packet to the web server by IP address, then forward the ACK packets back to the client. But you don't know the IP address to send the SYN packet to until 2).

You could set something up if you are talking about a reverse proxy and/or if your proxy only allows connection to a single website. In that case you know the server's IP address upfront and can use NAT to reroute the connection to that server.

Alternatively, why not consider setting up a second, non-caching proxy server in front of your sometimes-up squid server? You should be more easily able to configure that to cope with the main squid server going down than by managing a set of iptables rules.

Another option might be to make your squid server an intercepting proxy server. This means you don't need to set up a proxy on the Windows machine, and when it goes down then the Windows box will just continue to use the web as before. Of course, you then lose the ability to do any iptables filtering.
 
Old 09-08-2009, 04:10 PM   #5
clvic
Member
 
Registered: Feb 2008
Location: Rome, Italy
Distribution: OpenSuSE 11.x, vectorlinux, slax, Sabayon
Posts: 206
Blog Entries: 2

Rep: Reputation: 44
I confirm that rjlee explained very well, exactly what I tried to explain. Thanks!
 
Old 09-08-2009, 04:33 PM   #6
redss
Member
 
Registered: Jun 2003
Posts: 147

Original Poster
Rep: Reputation: 16
Understood! I wonder if there is a much more lightweight, non-caching proxy than squid... any suggestions?
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off
Trackbacks are Off
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
iptables question belkens Linux - Networking 10 08-15-2009 01:31 AM
iptables question yongitz Linux - Security 1 08-28-2006 04:05 AM
iptables question stny Linux - Security 7 03-04-2006 05:34 AM
IPtables Question jacovds Linux - Security 10 11-17-2003 09:46 AM
iptables question Ice9 Linux - Networking 1 02-20-2003 02:25 PM


All times are GMT -5. The time now is 02:39 PM.

Main Menu
 
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: @linuxquestions
Open Source Consulting | Domain Registration