Bug 110959 - Package redirection (transparent proxy) don't work
Package redirection (transparent proxy) don't work
Status: CLOSED WONTFIX
Product: Fedora
Classification: Fedora
Component: kernel (Show other bugs)
1
i386 Linux
medium Severity medium
: ---
: ---
Assigned To: Dave Jones
Brian Brock
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2003-11-25 17:09 EST by Marcos Bellezi
Modified: 2015-01-04 17:04 EST (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2004-10-29 20:49:43 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Marcos Bellezi 2003-11-25 17:09:45 EST
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; pt-BR; rv:1.4.1)
Gecko/20031114

Description of problem:
When a setup the redirect rules for transparent proxy (redirect port
80 to 3128 for squid processing) it don't work. The packets continue
to go out without redirection.

Version-Release number of selected component (if applicable):
iptables-1.2.8-13

How reproducible:
Always

Steps to Reproduce:
1. Configure Squid for transparent proxy
2. Use the following iptables rules:

:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -i eth0 -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p 51 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT
*nat
-A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128
-A POSTROUTING -s 192.168.0.0/24 -o ppp0 -j MASQUERADE
COMMIT


The eth0 is my internal network. The routing is enabled. The NAT is
working perfectly.

Any clue?

Additional info:
Comment 1 Ted Kaczmarek 2003-12-07 20:51:56 EST
I see an issue in the Prerouting chain as well, 
-A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j DNAT
--to-destination 192.168.20.21:80
-A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j LOG --log-prefix
"DNAT IN HTTP OK: " --log-level 1

tcpdump shows packet leaving the egress interface but they are not.
192.168.20.21 is on eth1. Packets gets lost before they get to nic card.
I686
iptables-1.2.8-13
2.4.22-1.2129.nptl
Comment 2 Thomas Woerner 2004-10-07 10:11:23 EDT
This is a netfilter problem, assigning to kernel.
Comment 3 Dave Jones 2004-10-29 20:49:43 EDT
FC1 = EOL

Note You need to log in before you can comment on or make changes to this bug.