Re: Iptables/Ebtables + bridge with proxy

Op di, 18-10-2005 te 20:14 +0200, schreef Adam N.:
> Hello
> I want use bridge box redirect packet from user to transparent
> proxy(squid) i read howto and mailing list but i can't find answer to my
> problem.
> 
> in ebtables i use:
> ebtables -t broute -A BROUTING -p IPv4 --ip-protocol 6 --ip-source
> v.x.y.z --ip-destination-port 80 -j redirect --redirect-target
> ACCEPT
> 
> in iptables i use:
> iptables -A PREROUTING -t nat -p tcp -s v.x.y.z --dport 80 -j DNAT
> --to-destination 172.16.0.3:8080
> 
> in proxy i add:
> http_port 172.16.0.3:8080
> httpd_accel_host virtual
> httpd_accel_port 80
> httpd_accel_with_proxy  on
> httpd_accel_uses_host_header on
> 
> if i do: ebtables -t broute -L --Lx i see counters in the end of 
> and in iptables -t nat -nvL i see counters but whene i try open 
> www.google.com i can't connect to host and proxy log is empty.
> 
> I use kernel 2.6.13.3 with l7-filter, iptables 1.3.0, ebtables 2.0.6,
> proxy 2.5.9-10sarge2 and my system: Debian Sarge.
> 
> Anybody kan help ?

Following up on our talk on the irc channel, this works fine with me:

setup: br0=eth0+eth1
br0=192.168.0.138
eth0=eth1=0.0.0.0
ebtables -t broute -A BROUTING -p ipv4 --ip-src 192.168.0.111 --ip-dst
192.168.0.1 --ip-proto icmp -j redirect --redirect-target DROP
iptables -t nat -A PREROUTING -p icmp -s 192.168.0.111 -d 192.168.0.1 -j
DNAT --to-destination 192.168.0.138

The ping requests from 192.168.0.111 are responded by the bridge. This
also works without the ebtables rule.
Tested on: 2.6.14-rc4 and 2.6.9-1.667 (FC3).

First get this to work, then using the proxy should be easy.

cheers,
Bart




-------------------------------------------------------
This SF.Net email is sponsored by:
Power Architecture Resource Center: Free content, downloads, discussions,
and more. http://solutions.newsforge.com/ibmarch.tmpl