From owner-freebsd-net Wed Mar 5 8:32:16 2003 Delivered-To: freebsd-net@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id E3F9137B401 for ; Wed, 5 Mar 2003 08:32:13 -0800 (PST) Received: from mail2.dbitech.ca (radius.wavefire.com [64.141.13.252]) by mx1.FreeBSD.org (Postfix) with SMTP id CE2FC43F3F for ; Wed, 5 Mar 2003 08:32:11 -0800 (PST) (envelope-from darcy@wavefire.com) Received: (qmail 11399 invoked from network); 5 Mar 2003 16:53:19 -0000 Received: from dbitech.wavefire.com (HELO dbitech) (darcy@64.141.15.253) by radius.wavefire.com with SMTP; 5 Mar 2003 16:53:19 -0000 Content-Type: text/plain; charset="iso-8859-1" From: Darcy Buskermolen Organization: Wavefire Technologies Corp. To: "soheil soheil" , freebsd-net@freebsd.org Subject: Re: Transparent Proxy Date: Wed, 5 Mar 2003 08:32:08 -0800 User-Agent: KMail/1.4.3 References: In-Reply-To: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Message-Id: <200303050832.08348.darcy@wavefire.com> Sender: owner-freebsd-net@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org I thank everybody who took the time to reply to me, and I found the probl= em,=20 my fwd/skipto rules needed to be after the divert rules. On Wednesday 05 March 2003 03:19, soheil soheil wrote: > I think if you add the following rule to the ipfw rules on 192.168.0.1 = ( > the squid-running host ) you can have your proxy working. > > skipto 510 tcp from 192.168.0.1 to any dst-port 80 > > > > From: Darcy Buskermolen > > >To: freebsd-net@freebsd.org > >Subject: Transparent Proxy > >Date: Tue, 25 Feb 2003 16:42:09 -0800 > > > > > >(Promoted to -net due to lack of responces on -questions) > > > > > >I'm trying to deploy a transparent proxy server for a friend's office = but > >have > >run into a couple of snags that I can't seam to find the correct answe= r > >for. > >Please see http://home2.dbitech.bc.ca:8080/netconfig.txt for graphical > >topology > > > >Note that I'm running IPFW2 on both BSD boxes. > > > >ipfw list output on 192.168.0.254: > > > >00001 skipto 50000 tcp from any 1023-65535 to me dst-port 22 > >00040 skipto 50 tcp from 192.168.0.1 to any dst-port 80 > >00048 fwd 192.168.0.1 tcp from 192.168.0.0/24 to any dst-port 80 out > >00999 divert 8669 ip from any to any via ed0 > >65533 allow ip from any to any > >65535 deny ip from any to any > > > >ipfw list output on 192.168.0.1: > > > >00500 fwd 127.0.0.1,3128 ip from 192.168.0.0/16 to any dst-port 80 in > >65000 allow ip from any to any > >65535 deny ip from any to any > > > >When the windows box (192.168.0.32) makes a web request it gets forwar= ded > >to > >the squid machine fine, and squid returns a "access denied" error mess= age, > >checking the cache.log on squid I see the reason is as follows: > > > >2003/02/20 04:19:47| WARNING: Forwarding loop detected for: > >GET / HTTP/1.0 > > > >All the information I can find online regaring setting up transparent > >proxying > >for squid using ipfw shows squid running on the gateway host, or on a > >diffrent network segment. Can anybody point me in the correct directi= on > > to tell me what it is that I'm missing? > > > >-- > >Darcy Buskermolen > >Wavefire Technologies Corp. > >ph: 250.717.0200 > >fx: 250.763.1759 > >http://www.wavefire.com > > > >To Unsubscribe: send mail to majordomo@FreeBSD.org > >with "unsubscribe freebsd-net" in the body of the message > > _________________________________________________________________ > STOP MORE SPAM with the new MSN 8 and get 2 months FREE* > http://join.msn.com/?page=3Dfeatures/junkmail --=20 Darcy Buskermolen Wavefire Technologies Corp. ph: 250.717.0200 fx: 250.763.1759 http://www.wavefire.com To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-net" in the body of the message