Re: interface or source ip match using brouting - transparent proxy

* Bart De Schuymer <[email protected]> [2006-04-19 23:41]:
> > hi, internally I am using 10/8 ip network and internal bridge card is
> > eth1, I am using iptables and ebtables. I want only internal trafic
> > incoming through eth1 to proxy, so I use:
> > 
> > ebtables -t broute -A BROUTING -p IPv4 -i eth1 --ip-src 10.0.0.0/8
> > --ip-protocol 6 --ip-destination-port 80 -j redirect --redirect-target
> > ACCEPT
> > 
> > but I try to swap cables between eth0 and eth1, and all works the same
> > way, even when I change client IP. Once tried match by source MAC, it
> > did not work as well. I tried with ubuntu breezy and 
> > now latest dapper wit 2.6.15 kernel. Please advise me if I am doing
> > something wrong way or ebtables just does not support that way and I
> > should go other way?
> 
> Please give an exact description of what you think is supposed to happen
> and what is actually happening.

I want to redirect web trafic passing through the bridge to the proxy server squid running on the bridge.

so when I want to redirect only trafic coming from LAN i try using "-i eth1", but that redirects trafic from eth0 as well, but it shouldnt?

when I want to redirect trafic coming only from ip range 10.0.0.0/8 I use rule --ip-src 10.0.0.0/8, but traffic passing bridge from other ips get's caugh as well.

but it catches only "--ip-destination-port 80". So at least one rule works. Why "-i eth1" and "--ip-src 10.0.0.0/8" does not do filtering for me?

Many thanks,
Andrius


-------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642