From owner-freebsd-ipfw Tue Mar 5 0: 1:21 2002 Delivered-To: freebsd-ipfw@freebsd.org Received: from rwcrmhc54.attbi.com (rwcrmhc54.attbi.com [216.148.227.87]) by hub.freebsd.org (Postfix) with ESMTP id 383D037B400 for ; Tue, 5 Mar 2002 00:01:17 -0800 (PST) Received: from blossom.cjclark.org ([12.234.91.48]) by rwcrmhc54.attbi.com (InterMail vM.4.01.03.27 201-229-121-127-20010626) with ESMTP id <20020305080116.KKRB1214.rwcrmhc54.attbi.com@blossom.cjclark.org>; Tue, 5 Mar 2002 08:01:16 +0000 Received: (from cjc@localhost) by blossom.cjclark.org (8.11.6/8.11.6) id g2581Eb90045; Tue, 5 Mar 2002 00:01:14 -0800 (PST) (envelope-from cjc) Date: Tue, 5 Mar 2002 00:01:14 -0800 From: "Crist J. Clark" To: Jeff Koftinoff Cc: freebsd-ipfw@FreeBSD.ORG Subject: Re: Transparent proxy for connections originating on localhost Message-ID: <20020305000114.U87533@blossom.cjclark.org> Reply-To: cjclark@alum.mit.edu References: <20020304231157.T87533@blossom.cjclark.org> <556A6480-300B-11D6-A2D9-003065709198@mac.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5i In-Reply-To: <556A6480-300B-11D6-A2D9-003065709198@mac.com>; from jeffkoftinoff@mac.com on Mon, Mar 04, 2002 at 11:33:48PM -0800 X-URL: http://people.freebsd.org/~cjc/ Sender: owner-freebsd-ipfw@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG On Mon, Mar 04, 2002 at 11:33:48PM -0800, Jeff Koftinoff wrote: > > On Monday, March 4, 2002, at 11:11 PM, Crist J. Clark wrote: > > >> > >> When I originate the connection on an external computer, the fwd works. > >> When I originate the connection on the same computer that has the fwd > >> rule, the fwd rule causes the connect to hang. > > > > Hmmm... Wouldn't happen to have a, > > > > pass ip from any to any via lo0 > > > > At the top of your rules? > > > > The only other rule I have is the default allow at the end. > sudo /sbin/ipfw show > 65535 23381230 14310099719 allow ip from any to any > > Do I have to make my fwd rule operate in reverse or something? Or should > I explicitely specify the network interfaces? Or could it be that the > following is happening: > 1) OS-X has the older ipfw code which requires the packets to > be headed to an external interface The packet just has to be leaving. > 2) My initial request comes from an internal process and is > going to an external IP > 3) ipfw fwd redirects the first outgoing packet to 127.0.0.1:9999 > 4) the response packet is heading back to the internal address > 5) because the response packet is internal, it is not properly > munged by the ipfw fwd code. > > Does that sound feasable? So betcha what I am trying to do would work > fine on a new FreeBSD system, right? Accessing external webservers from the machine running the proxy should work. Any time the packets are leaving the system, it should work. -- Crist J. Clark | cjclark@alum.mit.edu | cjclark@jhu.edu http://people.freebsd.org/~cjc/ | cjc@freebsd.org To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-ipfw" in the body of the message