Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have configured a squid transparent tproxy. All works fine.

Now I need all the traffic going to an external IP (internet) does not pass through the proxy.

Do I need to modify iptables, ebetables rules or change the configuration of squid?

I found this tutorial, but it doesn't use the tproxy rules.

iptables rules:

iptables -F -t mangle
iptables -X -t mangle
iptables -t mangle -N DIVERT
iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT

iptables -t mangle -A DIVERT -j MARK --set-mark 1
iptables -t mangle -A DIVERT -j ACCEPT

iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 3129

ebtables rules:

ebtables -t broute -A BROUTING -i eth1 -p ipv4 --ip-proto tcp --ip-dport 80 -j redirect --redirect-target DROP
ebtables -t broute -A BROUTING -i eth0 -p ipv4 --ip-proto tcp --ip-sport 80 -j redirect --redirect-target DROP

Looks like I need to insert the bypass rules before the first ebtables rule. Is that correct?

Do these rules works?

ebtables -t broute -A BROUTING -i eth1 -p ipv4 --ip-proto -d IP_dest -j ACCEPT
ebtables -t broute -A BROUTING -i eth0 -p ipv4 --ip-proto -s IP_dest -j ACCEPT
share|improve this question
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.