Bug 110959 - Package redirection (transparent proxy) don't work
Summary: Package redirection (transparent proxy) don't work
Status: CLOSED WONTFIX
Alias: None
Product: Fedora
Classification: Fedora
Component: kernel   
(Show other bugs)
Version: 1
Hardware: i386
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Dave Jones
QA Contact: Brian Brock
URL:
Whiteboard:
Keywords:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2003-11-25 22:09 UTC by Marcos Bellezi
Modified: 2015-01-04 22:04 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2004-10-30 00:49:43 UTC
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

Description Marcos Bellezi 2003-11-25 22:09:45 UTC
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; pt-BR; rv:1.4.1)
Gecko/20031114

Description of problem:
When a setup the redirect rules for transparent proxy (redirect port
80 to 3128 for squid processing) it don't work. The packets continue
to go out without redirection.

Version-Release number of selected component (if applicable):
iptables-1.2.8-13

How reproducible:
Always

Steps to Reproduce:
1. Configure Squid for transparent proxy
2. Use the following iptables rules:

:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -i eth0 -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p 51 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT
*nat
-A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128
-A POSTROUTING -s 192.168.0.0/24 -o ppp0 -j MASQUERADE
COMMIT


The eth0 is my internal network. The routing is enabled. The NAT is
working perfectly.

Any clue?

Additional info:

Comment 1 Ted Kaczmarek 2003-12-08 01:51:56 UTC
I see an issue in the Prerouting chain as well, 
-A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j DNAT
--to-destination 192.168.20.21:80
-A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j LOG --log-prefix
"DNAT IN HTTP OK: " --log-level 1

tcpdump shows packet leaving the egress interface but they are not.
192.168.20.21 is on eth1. Packets gets lost before they get to nic card.
I686
iptables-1.2.8-13
2.4.22-1.2129.nptl


Comment 2 Thomas Woerner 2004-10-07 14:11:23 UTC
This is a netfilter problem, assigning to kernel.

Comment 3 Dave Jones 2004-10-30 00:49:43 UTC
FC1 = EOL



Note You need to log in before you can comment on or make changes to this bug.