Re: forwarding loop

Article View: bit.listserv.openbsd-pf

Article #155

Back to bit.listserv.openbsd-pf Previous Next

#155

From: Karl O. Pinc
Date: Tue, 15 Jan 2013 18:33

29 lines
2009 bytes

On 01/15/2013 04:10:33 AM, Daniel Hartmeier wrote:
> Wait, the squid server is on a separate host, on the $int_if side of
> the
> firewall (the same side the clients are on)?
> 
> Then transparent proxying would require "reflection", and doesn't
> work, see
> http://www.openbsd.org/faq/pf/rdr.html#reflect

Just read the FAQ and had a few thoughts.

Something that's not mentioned that
comes to mind is ICMP redirection.  (Without thinking
about it a lot it seems like it should be a good candidate.)
However when I tried ICMP redirection on OpenBSD
years ago I couldn't get it to work.  Never looked to see why, 
or whether it's been fixed since.  Or, I might have been doing 
something wrong.   If anyone can send a clue my way
I'd appreciate knowing more.

Another option for TCP proxying that's not mentioned
is socat.   It's like nc, but (I think) would not require
inetd.

Regards,

Karl <kop@meme.com>
Free Software:  "You don't pay back, you pay forward."
                 -- Robert A. Heinlein

Technical Details

Message-ID: <1358264797.8274.1@mofo>

Path:

arc1-ca.pugleaf.net!6ni107660pbd.1!nntp.google.com!npeer02.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!spln!newsgate.newsguy.com!newsp.newsguy.com!mdrn

References: <20130115101033.GA2410@insomnia.benzedrine.cx> (from daniel@benzedrine.cx on Tue Jan 15 04:10:33 2013)

Show Full Headers

Complete Article Headers

X-Google-Thread: ff4ef,65dda175aebfa248
X-Google-NewGroupId: yes
X-Google-Attributes: gidbffa70e3,domainid0,public,usenet
X-Google-Language: ENGLISH,ASCII-7-bit
X-Received: by 10.68.226.168 with SMTP id rt8mr15685707pbc.8.1358274820139;
        Tue, 15 Jan 2013 10:33:40 -0800 (PST)
Path: arc1-ca.pugleaf.net!6ni107660pbd.1!nntp.google.com!npeer02.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!spln!newsgate.newsguy.com!newsp.newsguy.com!mdrn
From: kop@meme.com (Karl O. Pinc)
Newsgroups: bit.listserv.openbsd-pf
Subject: Re: forwarding loop
Date: 15 Jan 2013 10:33:38 -0800
Organization: None
Lines: 30
Message-ID: <1358264797.8274.1@mofo>
References: <20130115101033.GA2410@insomnia.benzedrine.cx> (from
 daniel@benzedrine.cx on Tue Jan 15 04:10:33 2013)
NNTP-Posting-Host: mofo
Mime-Version: 1.0
NNTP-Posting-Date: 15 Jan 2013 18:33:39 GMT
X-Received-Bytes: 1638
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 8bit

Reply to Parent Message