Linux - NetworkingThis forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.
Notices
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
I don't think so. SQUID is specially made to act as a proxy - that is, it will examine messages (network packets) at application level, look inside them, and then decide. That is, the browser (if it's a browser) that contacts squid, contacts it directly and then tells it to forward a request.
iptables is mainly made to act at a lower level. So, if you try to contact SQUID and it's not there to answer, you won't know where the request was directed.
I don't know if this is clear enough - it also depends on how much you know TCP/IP networking.
I don't understand why any intelligent decisions need to be made, since at a low level the packets just need to continue to go on their merry way.
Ok put a different way - say for example I do arp spoofing to turn my linux box into a gateway for a windows pc on the LAN. If ip forwarding (/proc/sys/net/ipv4/ip_forward) is on, then the windows box will continue to operate without DOS. If I reroute with the following command:
iptables -t nat -A PREROUTING -i eth0 -p tcp --destination-port 80 -j REDIRECT --to-port 8080
Then is there another iptables command that will forward the packets without requiring a proxy to handle the traffic on port 8080?
I'm not sure of the iptables details, but I can at least answer your second question:
There is no general solution to this, since the way an HTTP proxy works is 1) the web browser establishes a connection to the proxy server, then 2) it sends the URL for the requested webpage.
You can't use NAT to establish a connection, only to do lower-level packet filtering where the SYN and ACK packets are passed back and forth between the client and destination, so you can only achieve 1) by forwarding the SYN packet to the web server by IP address, then forward the ACK packets back to the client. But you don't know the IP address to send the SYN packet to until 2).
You could set something up if you are talking about a reverse proxy and/or if your proxy only allows connection to a single website. In that case you know the server's IP address upfront and can use NAT to reroute the connection to that server.
Alternatively, why not consider setting up a second, non-caching proxy server in front of your sometimes-up squid server? You should be more easily able to configure that to cope with the main squid server going down than by managing a set of iptables rules.
Another option might be to make your squid server an intercepting proxy server. This means you don't need to set up a proxy on the Windows machine, and when it goes down then the Windows box will just continue to use the web as before. Of course, you then lose the ability to do any iptables filtering.
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know.