Sponsored Content
Special Forums Cybersecurity IPNAT / Transparent proxy loops... Post 30309 by indo1144 on Sunday 20th of October 2002 11:43:02 AM
Old 10-20-2002
IPNAT / Transparent proxy loops...

Hi!

My situation:

I have an OpenBSD firewall/proxy (192.168.0.1), running IPF/IPNAT w/ Squid as transparent proxy. This machine is configured to be gateway to the network.

This works great, all the clients WWW-requests on the internal network are rerouted to the proxyport by this IPNAT-rule:

rdr fxp0 0.0.0.0/0 port 80 -> 192.168.0.1 port 3128

However, I would like to use another machine as a transparent proxy and have run into some problems... The new machine runs Solaris 8 i386 (192.168.0.2) and I have succesfully compiled and configured Squid. I use the same config I used with the "firewall-squid-version".
After changing the IPNAT-rule to:

rdr fxp0 0.0.0.0/0 port 80 -> 192.168.0.2 port 3128

It won't work... I can see a message: Website found, waiting for reply, but figure this is only because DNS-lookup of the website was succesfull. DNS-lookups are punched through the firewall and happen independently from the squid-proxy.

What I figure happened is this:

- A client wants to connect to the internet.
- Request travels to 192.168.0.1 port 80
- Request is redirected to squid on 192.168.0.2 port 3128
- Squid on 192.168.0.2 wants to connect to the internet.
- Squid on 192.168.0.2 connects to 192.168.0.1 port 80
- Squid-request is redirected to squid on 192.168.0.2 port 3128 instead of to internet (because of IPNAT-rule stated above)
- And it continues to loop...

How can I change my IPNAT-rules so that all clients are redirected to 192.168.0.2 port 3128 _AND_ 192.168.0.2 itself is allowed direct access to the internet?
 

9 More Discussions You Might Find Interesting

1. IP Networking

Destination NAT using ipnat in Solaris 8

Hello People, Please can someone help me with destination IP address NAT and Port transalation using ipnat in Solaris 8. Scenario: Box A(192.168.100.1/24) and Box B (192.168.100.50/24) are connected phyically and logically(vlan) on the same network switch. Box A hosts an... (0 Replies)
Discussion started by: mandarawachat
0 Replies

2. IP Networking

SQUID Transparent Proxy Server

hi guys! We are setting up Squid Server. we want the server to be transparent. But I don't know how will i be able to set the network up. is it possible to set the squid server in the same LAN with the Squid Client and still functions as a transparent server? if so, can anybody help me do it? ... (1 Reply)
Discussion started by: init6_
1 Replies

3. IP Networking

Software/tool to route an IP packet to proxy server and capture the Proxy reply as an

Hi, I am involved in a project on Debian. One of my requirement is to route an IP packet in my application to a proxy server and receive the reply from the proxy server as an IP packet. My application handles data at the IP frame level. My application creates an IP packet(with all the necessary... (0 Replies)
Discussion started by: Rajesh_BK
0 Replies

4. Shell Programming and Scripting

Need help with a shell script:Config Transparent Proxy using Shell

I want to config Transparent Proxy using Shell Script. I have more questions<exercise of me :D>: + Check that the squid is installed or not install and version is installed +Allows users to choose to run a transparent proxy or not +Perform configuration and turn on service in accordance... (0 Replies)
Discussion started by: kaka287
0 Replies

5. Linux

Freebsd IPNAT

I need to figure out how to exclude RDP from mapping, i am mapping as follows map le0 10.1.0.0/24 -> 10.1.0.10/32 however i need to exclude rdp so i can still rdp to machines on the 10.1.0.0/24 network.. Can somebody please advise how i could do this ? (0 Replies)
Discussion started by: boxalld
0 Replies

6. UNIX for Advanced & Expert Users

ipf/ipnat NAT/port forward issues

I've been going crazy trying to get this working. Here's the situation: we have a Solaris 10 box that connects an internal network to an external network. We're using ipf/ipnat on it. We've added a couple of new boxes to the internal network (192.168.1.100, .101) and want to be able to get to port... (1 Reply)
Discussion started by: spakov
1 Replies

7. IP Networking

Transparent Proxy with URL Rewriting

All traffic on the LAN is routed through a single machine and filtered using iptables. I'd like to redirect this traffic to a transparent proxy running on the same machine that will rewrite the URL if it matches a specified regex, in which case the user will be redirected to a local server. In... (0 Replies)
Discussion started by: crottyan
0 Replies

8. IP Networking

Connecting via proxy chain to Upstream proxy

I need to configure a proxy on my local machine to use an upstream proxy (installed on another machine). The upstream proxy requires Digest/NTLM authorization. I want the local proxy to deal with the upstream proxy's authorization details and provides authorization free access to users that connect... (0 Replies)
Discussion started by: Russel
0 Replies

9. UNIX for Advanced & Expert Users

Issue setup Transparent proxy and Gateway using Squid on CentOS 7

Hello, We are migrating our gateways from CentOS 6 to CentOS 7 and for setting up a transparent proxy using squid and Firewalld i am using below configuration. #Firewalld configurations firewall-cmd --permanent --zone=public --add-forward-port=port=80:proto=tcp:toport=3128:toaddr=LAN_IP... (4 Replies)
Discussion started by: sunnysthakur
4 Replies
ssh-http-proxy-connect(1)					   User Commands					 ssh-http-proxy-connect(1)

NAME
ssh-http-proxy-connect - Secure Shell proxy for HTTP SYNOPSIS
/usr/lib/ssh/ssh-http-proxy-connect [-h http_proxy_host] [-p http_proxy_port] connect_host connect_port DESCRIPTION
A proxy command for ssh(1) that uses HTTP CONNECT. Typical use is where connections external to a network are only allowed via a proxy web server. OPTIONS
The following options are supported: -h http_proxy_host Specifies the proxy web server through which to connect. Overrides the HTTPPROXY and http_proxy environment variables if they are set. -p http_proxy_port Specifies the port on which the proxy web server runs. If not specified, port 80 is assumed. Overrides the HTTPPROXY- PORT and http_proxy environment variables if they are set. OPERANDS
The following operands are supported: http_proxy_host The host name or IP address (IPv4 or IPv6) of the proxy. http_proxy_port The numeric port number to connect to on http_proxy_host. connect_host The name of the remote host to which the proxy web server is to connect you. connect_port The numeric port number of the proxy web server to connect you to on http_proxy_host. EXAMPLES
The recommended way to use a proxy connection command is to configure the ProxyCommand in ssh_config(4) (see Example 1 and Example 2). Example 3 shows how the proxy command can be specified on the command line when running ssh(1). Example 1 Setting the proxy from the environment The following example uses ssh-http-proxy-connect in ssh_config(4) when the proxy is set from the environment: Host playtime.foo.com ProxyCommand /usr/lib/ssh/ssh-http-proxy-connect playtime.foo.com 22 Example 2 Overriding proxy environment variables The following example uses ssh-http-proxy-connect in ssh_config(4) to override (or if not set) proxy environment variables: Host playtime.foo.com ProxyCommand /usr/lib/ssh/ssh-http-proxy-connect -h webcache -p 8080 playtime.foo.com 22 Example 3 Using the command line The following example uses ssh-http-proxy-connect from the ssh(1) command line: example$ ssh -o'ProxyCommand="/usr/lib/ssh/ssh-http-proxy-connect -h webcache -p 8080 playtime.foo.com 22"' playtime.foo.com ENVIRONMENT VARIABLES
HTTPPROXY Takes the http_proxy_host operand to specify the default proxy host. Overrides http_proxy if both are set. HTTPPROXYPORT Takes the http_proxy_port operand to specify the default proxy port. Ignored if HTTPPROXY is not set. http_proxy URL format for specifying proxy host and port. EXIT STATUS
The following exit values are returned: 0 Successful completion. 1 An error occurred. ATTRIBUTES
See attributes(5) for descriptions of the following attributes: +-----------------------------+-----------------------------+ | ATTRIBUTE TYPE | ATTRIBUTE VALUE | +-----------------------------+-----------------------------+ |Availability |SUNWsshu | +-----------------------------+-----------------------------+ |Interface Stability |Stable | +-----------------------------+-----------------------------+ SEE ALSO
ssh(1), ssh-socks5-proxy-connect(1), ssh_config(4), attributes(5) SunOS 5.11 24 Oct 2001 ssh-http-proxy-connect(1)
All times are GMT -4. The time now is 05:01 PM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy