Re: ipfilter and transparent proxy through squid

Jim Klimov <[email protected]> Wed, 11 May 2011 14:36:05 +0400
Newsgroups gmane.comp.security.firewalls.ipfilter
Organization JSC COS/HT
Message-ID <[email protected]> 
This is a multi-part message in MIME format.
--------------040408050701060800030202
Content-Type: text/plain; charset=windows-1251; format=flowed
Content-Transfer-Encoding: quoted-printable
X-MIME-Autoconverted: from 8bit to quoted-printable by anumail9.anu.edu.au id p4BAdr3a026611

2011-05-11 11:13, Gabriele Bulfon =EF=E8=F8=E5=F2:
> hi, there is a "small" issue with rdr to do transparent proxy :
>
> rdr igb0 0.0.0.0/0 port 80 -> 127.0.0.1 port 8080
>
> how can I decide to "transparent proxy" just specific clients?
> also, I may want to NOT "transparent proxy" when going to specific=20
> destinations (such as
> internal web servers).
>
> thanx for any help.
> Gabriele.
>

Well, on a different occasion we have a NAT ruleset with
many exceptions, which may serve as a syntax exapmle:

# Local IPs go unchanged
map elxl1 from 192.168.129.0/24         to 192.168.186.0/24     -> 0.0.0.=
0/0
map elxl1 from 192.168.129.0/24         to 192.168.187.0/24     -> 0.0.0.=
0/0
map elxl1 from 192.168.129.0/24         to 192.168.188.0/24     -> 0.0.0.=
0/0

map elxl1 from 192.168.119.0/24         to 192.168.186.0/24     -> 0.0.0.=
0/0
map elxl1 from 192.168.119.0/24         to 192.168.187.0/24     -> 0.0.0.=
0/0
map elxl1 from 192.168.119.0/24         to 192.168.188.0/24     -> 0.0.0.=
0/0

# NAT for a specific subnet going to default route
map elxl1 from 192.168.129.224/28 ! to 192.168.186.0/22 -> 93.175.31.10/3=
2

I think when you use the rules like the last one,
only the first line for a given source IP/net
actually matters. If you have other exclusions
this way, they may get "shadowed" by the first.

And you can't use pools (as of IPF4 at least)
in NAT configs, so the setup file gets very big.


--=20


+=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D+
|                                                            |
| =CA=EB=E8=EC=EE=E2 =C5=E2=E3=E5=ED=E8=E9,                              =
   Jim Klimov |
| =F2=E5=F5=ED=E8=F7=E5=F1=EA=E8=E9 =E4=E8=F0=E5=EA=F2=EE=F0             =
                      CTO |
| =C7=C0=CE "=D6=CE=D1 =E8 =C2=D2"                                  JSC C=
OS&HT |
|                                                            |
| +7-903-7705859 (cellular)          mailto:[email protected] |
|                          CC:[email protected],[email protected] |
+=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D+
| ()  ascii ribbon campaign - against html mail              |
| /\                        - against microsoft attachments  |
+=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D+




--------------040408050701060800030202
Content-Type: text/html; charset=windows-1251
Content-Transfer-Encoding: quoted-printable
X-MIME-Autoconverted: from 8bit to quoted-printable by anumail9.anu.edu.au id p4BAdr3a026611

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
  <head>
    <meta content=3D"text/html; charset=3Dwindows-1251"
      http-equiv=3D"Content-Type">
  </head>
  <body bgcolor=3D"#ffffff" text=3D"#000000">
    2011-05-11 11:13, Gabriele Bulfon =EF=E8=F8=E5=F2:
    <blockquote
cite=3D"mid:27950_1305098981_4DCA3AE5_27950_911_1_29837820.39.13050980182=
89.JavaMail.root@www"
      type=3D"cite">
      <div style=3D"font-family: Verdana; font-size: 12px;">hi, there is =
a
        "small" issue with rdr to do transparent proxy :<br>
        <br>
        rdr igb0 0.0.0.0/0 port 80 -&gt; 127.0.0.1 port 8080<br>
        <br>
        how can I decide to "transparent proxy" just specific clients?<br=
>
        also, I may want to NOT "transparent proxy" when going to
        specific destinations (such as<br>
        internal web servers).<br>
        <div><br>
          thanx for any help.<br>
          Gabriele.<br>
          <br>
        </div>
      </div>
    </blockquote>
    <br>
    Well, on a different occasion we have a NAT ruleset with <br>
    many exceptions, which may serve as a syntax exapmle:<br>
    <br>
    # Local IPs go unchanged<br>
    map elxl1 from 192.168.129.0/24=A0=A0=A0=A0=A0=A0=A0=A0 to 192.168.18=
6.0/24=A0=A0=A0=A0
    -&gt; 0.0.0.0/0<br>
    map elxl1 from 192.168.129.0/24=A0=A0=A0=A0=A0=A0=A0=A0 to 192.168.18=
7.0/24=A0=A0=A0=A0
    -&gt; 0.0.0.0/0<br>
    map elxl1 from 192.168.129.0/24=A0=A0=A0=A0=A0=A0=A0=A0 to 192.168.18=
8.0/24=A0=A0=A0=A0
    -&gt; 0.0.0.0/0<br>
    <br>
    map elxl1 from 192.168.119.0/24=A0=A0=A0=A0=A0=A0=A0=A0 to 192.168.18=
6.0/24=A0=A0=A0=A0
    -&gt; 0.0.0.0/0<br>
    map elxl1 from 192.168.119.0/24=A0=A0=A0=A0=A0=A0=A0=A0 to 192.168.18=
7.0/24=A0=A0=A0=A0
    -&gt; 0.0.0.0/0<br>
    map elxl1 from 192.168.119.0/24=A0=A0=A0=A0=A0=A0=A0=A0 to 192.168.18=
8.0/24=A0=A0=A0=A0
    -&gt; 0.0.0.0/0<br>
    <br>
    # NAT for a specific subnet going to default route<br>
    map elxl1 from 192.168.129.224/28 ! to 192.168.186.0/22 -&gt;
    93.175.31.10/32<br>
    <br>
    I think when you use the rules like the last one,<br>
    only the first line for a given source IP/net <br>
    actually matters. If you have other exclusions<br>
    this way, they may get "shadowed" by the first.<br>
    <br>
    And you can't use pools (as of IPF4 at least)<br>
    in NAT configs, so the setup file gets very big.<br>
    <br>
    <br>
    <pre class=3D"moz-signature" cols=3D"72">--=20


+=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D+
|                                                            |
| =CA=EB=E8=EC=EE=E2 =C5=E2=E3=E5=ED=E8=E9,                              =
   Jim Klimov |
| =F2=E5=F5=ED=E8=F7=E5=F1=EA=E8=E9 =E4=E8=F0=E5=EA=F2=EE=F0             =
                      CTO |
| =C7=C0=CE "=D6=CE=D1 =E8 =C2=D2"                                  JSC C=
OS&amp;HT |
|                                                            |
| +7-903-7705859 (cellular)          <a class=3D"moz-txt-link-freetext" h=
ref=3D"mailto:[email protected]">mailto:[email protected]</a> |
|                          <a class=3D"moz-txt-link-abbreviated" href=3D"=
mailto:CC:[email protected],[email protected]">CC:[email protected],jimklimov@mail.=
ru</a> |
+=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D+
| ()  ascii ribbon campaign - against html mail              |
| /\                        - against microsoft attachments  |
+=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D+


</pre>
  </body>
</html>

--------------040408050701060800030202--