Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have two boxes: 172.16.1.224 and 172.16.1.223.

Both are running Squid. I connect my browser to x.x.x.224, port 3128 using Firefox proxy settings. That works fine. If I connect my browser to x.x.x.223:3128 using Firefox proxy settings, it works fine.

Now, I'm trying to bridge the two boxes, such that when I connect o x.x.x.224:3124 using Firefox proxy settings, traffic gets routed to x.x.x.223 and then on to the web.

Any ideas on how I might do this? I'm struggling with iptables.

Many thanks in advance,

share|improve this question
add comment

2 Answers

That should do it:

iptables -t nat -A PREROUTING -p tcp -d x.x.x.224 --dport 3124 -j DNAT --to-destination x.x.x.223:3128

Furthermore if you don't already have another masquerading rule, you need

iptables -t nat -A POSTROUTING -p tcp -d x.x.x.223 --dport 3128 -j SNAT --to-source x.x.x.224

If you do this, you don't need to have squid running on .224, only on .223. But why can't you let clients connect to .223 directly ?

share|improve this answer
    
I think you also need a SNAT rule so 223 doesn't respond directly to the client. –  Eduardo Ivanec Jun 16 '11 at 10:51
    
Ah, right. I had an already NATted setup in mind. Thanks ! –  b0fh Jun 16 '11 at 11:01
    
Hey, the reason I can't let clients connect to .223 directly is that I'm modelling a remote site and a core network. Clients connect to remote site and then the remote site connects to core network (via a slow, high latency satellite link). –  Eamorr Jun 16 '11 at 11:19
    
I tried your iptables commands, but it didn't work... Is there a good way of debugging these things? Here is a link to a graphical depiction of my setup i55.tinypic.com/v761l5.png –  Eamorr Jun 16 '11 at 12:00
add comment

Given the network configuration you're trying to reproduce (high latency satellite link between the "real" .223 and .224 servers) I'd recommend against iptables.

Instead I would just link the two proxy servers - following the FAQ, you basically have to configure the remote server as a cache peer so all requests are forwarded to it.

This way you isolate the client better from the connection (TCP) latency and can easily cache content on the "right" side of the high latency connection.

share|improve this answer
    
Hey, thanks for your reply. Why would you recommend against IP tables? I set up a cache_peer which works fine, but I need to use IP tables as I want to forward traffic into a header compressor and an image compressor... –  Eamorr Jun 16 '11 at 11:58
    
Have you looked into wiki.squid-cache.org/Features/Redirectors? It may do what you need. What kind of compressor are you using? I don't know much about satellite links, but I fail to see the benefit of iptables in this case (please do tell me if I'm missing something). Using two squids would let the client connect (TCP) instantly and would (I assume) provide a better user experiencie. Also: you could give a nice, user friendly error message if the link goes down. –  Eduardo Ivanec Jun 16 '11 at 12:01
    
Redirectors looks interesting. Using rohc header compression. –  Eamorr Jun 16 '11 at 13:06
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.