Bug 110959

Summary: Package redirection (transparent proxy) don't work
Product: [Fedora] Fedora Reporter: Marcos Bellezi <mab>
Component: kernelAssignee: Dave Jones <davej>
Status: CLOSED WONTFIX QA Contact: Brian Brock <bbrock>
Severity: medium Docs Contact:
Priority: medium    
Version: 1CC: pfrields
Target Milestone: ---   
Target Release: ---   
Hardware: i386   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2004-10-30 00:49:43 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Marcos Bellezi 2003-11-25 22:09:45 UTC
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; pt-BR; rv:1.4.1)
Gecko/20031114

Description of problem:
When a setup the redirect rules for transparent proxy (redirect port
80 to 3128 for squid processing) it don't work. The packets continue
to go out without redirection.

Version-Release number of selected component (if applicable):
iptables-1.2.8-13

How reproducible:
Always

Steps to Reproduce:
1. Configure Squid for transparent proxy
2. Use the following iptables rules:

:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -i eth0 -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p 51 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT
*nat
-A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128
-A POSTROUTING -s 192.168.0.0/24 -o ppp0 -j MASQUERADE
COMMIT


The eth0 is my internal network. The routing is enabled. The NAT is
working perfectly.

Any clue?

Additional info:

Comment 1 Ted Kaczmarek 2003-12-08 01:51:56 UTC
I see an issue in the Prerouting chain as well, 
-A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j DNAT
--to-destination 192.168.20.21:80
-A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j LOG --log-prefix
"DNAT IN HTTP OK: " --log-level 1

tcpdump shows packet leaving the egress interface but they are not.
192.168.20.21 is on eth1. Packets gets lost before they get to nic card.
I686
iptables-1.2.8-13
2.4.22-1.2129.nptl


Comment 2 Thomas Woerner 2004-10-07 14:11:23 UTC
This is a netfilter problem, assigning to kernel.

Comment 3 Dave Jones 2004-10-30 00:49:43 UTC
FC1 = EOL