From owner-freebsd-questions@FreeBSD.ORG Sun Jun 15 16:48:06 2003 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 1BE8937B401 for ; Sun, 15 Jun 2003 16:48:06 -0700 (PDT) Received: from pa-plum1b-166.pit.adelphia.net (pa-plum1b-217.pit.adelphia.net [24.53.161.217]) by mx1.FreeBSD.org (Postfix) with ESMTP id 49E0D43FBD for ; Sun, 15 Jun 2003 16:48:05 -0700 (PDT) (envelope-from wmoran@potentialtech.com) Received: from potentialtech.com (working [172.16.0.95]) h5FNm3Og004450; Sun, 15 Jun 2003 19:48:04 -0400 (EDT) (envelope-from wmoran@potentialtech.com) Message-ID: <3EED05B3.9000204@potentialtech.com> Date: Sun, 15 Jun 2003 19:48:03 -0400 From: Bill Moran User-Agent: Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:1.3) Gecko/20030429 X-Accept-Language: en-us, en MIME-Version: 1.0 To: Andrew Thomson References: <20030613070438.GO15745@athomson.prv.au.itouchnet.net> <3EE9D5DD.1090209@potentialtech.com> <20030615234105.GD60583@athomson.prv.au.itouchnet.net> In-Reply-To: <20030615234105.GD60583@athomson.prv.au.itouchnet.net> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit cc: freebsd-questions@freebsd.org Subject: Re: more transparent proxy and squid questions. X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 15 Jun 2003 23:48:06 -0000 Andrew Thomson wrote: > On Fri, Jun 13, 2003 at 09:47:09AM -0400, Bill Moran wrote: > >>Yes. You've got the right idea. > > > hmm.. i have encountered some difficulties ;) so now i'm seeking some > more advice.. > > i have the following rules on my firewall: > > 10561 skipto 11000 ip from 192.168.1.2 to any > 10562 fwd 192.168.1.2,3128 tcp from 192.168.1.3 to any 80 > > keeping in line with my example, 1=fwall, 2=squid, 3=user > > the skipto is in there so we go through nat and get a proper ip. > > i never see any packets get to the squid box though.. > > ipfw show indicates matching packets > ipfw show 10561 10562 > 10561 5342 331306 skipto 11000 ip from 192.168.1.2 to any > 10562 2520 120960 fwd 192.168.1.2,3128 tcp from 192.168.1.3 to any 80 > > a tcpdump on the squid box looking out for port 3128 shows nothing, although > the ipfw shows matches.. > > i'll keep digging around but any more tips would be appreciated on this > setup. Someone else may have keener eyes, but for my part I can't guess what the problem could be from your description. Can you send your entire ipfw ruleset? (i.e. the complete output of 'ipfw show') Perhaps then I'll be able to get a better idea what you're doing. If 10562 is catching packets, then it's likely that it's somewhere else that the problem lie. -- Bill Moran Potential Technologies http://www.potentialtech.com