LinuxQuestions.org
Latest LQ Deal: Complete CCNA, CCNP & Red Hat Certification Training Bundle
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Server
User Name
Password
Linux - Server This forum is for the discussion of Linux Software used in a server related context.

Notices


Reply
  Search this Thread
Old 04-04-2008, 11:35 AM   #1
neothephoenix
Member
 
Registered: Oct 2006
Location: India
Distribution: Fedora Core 6, Archlinux Duke
Posts: 52

Rep: Reputation: 15
Outgoing Packet Redirection Using iptables (FC6)


Hi LQ,

I need to redirect all tcp packets leaving my server at port 80 to another server at its port 8080. I need to use iptables for that but just wanted to confirm before giving the command:

# iptables -t nat -A POSTROUTING -o eth0 -p tcp --dport 80 -j REDIRECT -d 10.10.1.45 --to-ports 8080
Just wanted to know if I'm giving the correct format. If not, can anyone spare the time to provide me with one.

Thanks in advance
 
Old 04-04-2008, 03:13 PM   #2
datopdog
Member
 
Registered: Feb 2008
Location: JHB South Africa
Distribution: Centos, Kubuntu, Cross LFS, OpenSolaris
Posts: 806

Rep: Reputation: 41
Thats incorrect the REDIRECT target only works in OUTPUT and PREROUTING chains.

You cannot redirect in POSTROUTING because the kernel has already taken the routing decision on where it is going to send the packet.
 
Old 04-04-2008, 04:04 PM   #3
neothephoenix
Member
 
Registered: Oct 2006
Location: India
Distribution: Fedora Core 6, Archlinux Duke
Posts: 52

Original Poster
Rep: Reputation: 15
Hi,
Let me be more specific.
I need to setup a squid proxy on FC6. My lan is 10.2.0.0/255.255.0.0
the open internet or IWSS machine is 10.75.1.5
Incoming http requests at port 8080, after getting authenticated via squid must go to the port 8080 of IWSS for internet access to happen. My proxy will be a non-transparent one, and all clients will send http requests to squid at port 8080 only.
Now, i need to modify the outgoing packets such that packets due to leave my proxy at port 80 hits IWSS at port 8080.
In other words, IWSS is like a proxy server to my squid proxy.

Any suggestions/help is hugely appreciated.
 
Old 04-05-2008, 06:54 AM   #4
datopdog
Member
 
Registered: Feb 2008
Location: JHB South Africa
Distribution: Centos, Kubuntu, Cross LFS, OpenSolaris
Posts: 806

Rep: Reputation: 41
Why dont you chain the squid server to the IWSS instead using ICP
 
Old 04-05-2008, 09:33 AM   #5
neothephoenix
Member
 
Registered: Oct 2006
Location: India
Distribution: Fedora Core 6, Archlinux Duke
Posts: 52

Original Poster
Rep: Reputation: 15
..... I don't quite follow you, datopdog.
Chain To iwss via icp?
 
Old 04-05-2008, 05:20 PM   #6
Deleriux
Member
 
Registered: Nov 2003
Posts: 89

Rep: Reputation: 16
What you probably want to do is this:
Code:
iptables -t nat -A PREROUTING -i interface_name_here -p tcp --dport 80 -j DNAT --to-destination 10.10.1.45:8080
 
Old 04-11-2008, 11:24 AM   #7
neothephoenix
Member
 
Registered: Oct 2006
Location: India
Distribution: Fedora Core 6, Archlinux Duke
Posts: 52

Original Poster
Rep: Reputation: 15
Smile

Hi LQ,
My approach was totally wrong, it seems squid server cannot be configure as a client to another proxy server and then cater to clients. So I first enabled a direct internet connection to the squid proxy itself and then I did a simple squid configuration, and it worked!
Here's my configuration:
eth0 10.75.1.80/255.255.0.0 gw 10.75.1.11 external Internet ip
eth1 10.2.1.40/255.255.0.0 gw 10.2.50.1 internal LAN ip
10.75.1.11 internet load balancer switch

route del -net default 10.2.50.1
route add -net default 10.75.1.11

enabled ip forwarding in sysctl.conf

/etc/squid/squid.conf

http_port 8080
hosts_file /etc/hosts
acl userlan src 10.2.0.0/255.255.0.0
http_access allow userlan

Now, my problem is squid is a bit slow to access. I'll search the LQ repo before starting a new thread.

Thanks all of you.

LQ Rocks!!!
 
Old 04-11-2008, 11:53 AM   #8
datopdog
Member
 
Registered: Feb 2008
Location: JHB South Africa
Distribution: Centos, Kubuntu, Cross LFS, OpenSolaris
Posts: 806

Rep: Reputation: 41
ICP is the internet cache protocol used by caches to build parent child relationships between caches meaning you could setup your cache as a child of the other IWSS cache.
 
Old 04-25-2008, 08:20 AM   #9
neothephoenix
Member
 
Registered: Oct 2006
Location: India
Distribution: Fedora Core 6, Archlinux Duke
Posts: 52

Original Poster
Rep: Reputation: 15
Quote:
Originally Posted by neothephoenix View Post
Hi LQ,
My approach was totally wrong, it seems squid server cannot be configure as a client to another proxy server and then cater to clients. So I first enabled a direct internet connection to the squid proxy itself and then I did a simple squid configuration, and it worked!
Squid can be configured to direct all http requests to another proxy. I had to redirect all client http requests to an iwss proxy. Here's the relevant lines in my squid.conf which eventually did that:

http_port 8080
cache_peer iwss1 parent 8080 0
never_direct allow all

After that the iwss server must have port 8080 opened on its side and consequently, after a service squid restart it was working.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Is there any program to monitor outgoing packet megerdin Linux - Newbie 3 02-13-2008 07:43 AM
iptables redirection mallikk_in Linux - Networking 11 09-02-2007 02:00 AM
Help:iptables redirection swmok Linux - Networking 2 11-24-2004 08:47 AM
IPtables Redirection Exception? BoarderX Linux - Networking 7 09-22-2004 07:43 PM
redirection of ftp using iptables bacon22 Linux - General 1 03-10-2004 06:21 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Server

All times are GMT -5. The time now is 09:23 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration