Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm have a web server X, a transparent squid proxy server P and I'm using iptables to redirect all outgoing traffic on X to P, such that when a page on X is accessed, X will retrieve/curl a page Z and return it to the browser.

When the browser access X

Browser --> Web server X --> Squid P --> Webpage Z

When the response is returned to Browser

Browser <-- Web server X <-- Squid P <-- Webpage Z

Problem: When I use a browser to access a page on X, web server X does not return anything, the page does not load. It's expected to show the contents of Z. However if I ask my browser to use proxy P to access X again, the page loads properly, showing the contents of Z!

This is truly confusing for me, anyone can explain what is happening and how the problem can be fixed?

iptable rules

iptables -t nat -A PREROUTING -i eth0 ! -s x.x.x.18 -p tcp --dport 80 -j DNAT --to x.x.x.18:3128
iptables -t nat -A POSTROUTING -o eth0 -s x.x.x.0/16 -d x.x.x.18 -j SNAT --to x.x.x.19

Wireshark (on Web server)

Filter: tcp.port==3128 or http

xx.xx.20.103: Browser

xxx.x.xxx.19: Web Server X (Browser access /test page, causing server to curl / of Z)

xxx.x.xxx.18: Squid P

209.68.27.1: Webpage Z

4   0.053750    xx.xx.20.103    xxx.x.xxx.18    TCP 66  55957 > ndl-aas [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM=1
6   0.237981    xx.xx.20.103    xxx.x.xxx.18    TCP 66  55958 > ndl-aas [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM=1
20  3.054375    xx.xx.20.103    xxx.x.xxx.18    TCP 66  55957 > ndl-aas [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM=1
22  3.253001    xx.xx.20.103    xxx.x.xxx.18    TCP 66  55958 > ndl-aas [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM=1
49  9.053487    xx.xx.20.103    xxx.x.xxx.18    TCP 62  55957 > ndl-aas [SYN] Seq=0 Win=8192 Len=0 MSS=1460 SACK_PERM=1
51  9.255391    xx.xx.20.103    xxx.x.xxx.18    TCP 62  55958 > ndl-aas [SYN] Seq=0 Win=8192 Len=0 MSS=1460 SACK_PERM=1

Wireshark (on Proxy)

Filter: tcp.port==3128 or http

Nothing
share|improve this question
    
This seems like a strange and somewhat complicated setup. What are you trying to achieve with it ? –  Iain Jan 5 '13 at 8:37
    
Use tcpdump, tshark or wireshark to see what's happening. –  BatchyX Jan 5 '13 at 9:57
    
What's the purpose of the POSTROUTING rule? –  David Schwartz Jan 5 '13 at 10:36
    
I'm planning to use the Squid proxy as a caching layer for a few of my servers that access other API servers very frequently. The POSTROUTINGrule ensures that the reply gets send through the web server rather than directly to the browser (I'm following tldp.org/HOWTO/TransparentProxy-6.html) –  Nyxynyx Jan 5 '13 at 14:49
    
Updated post with captures from tshark. –  Nyxynyx Jan 5 '13 at 16:02
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.