[Solved] /etc/hosts can't redirect ip to an ip

Falchion · n00b Joined: 18 Dec 2005 Posts: 57

hi,
I just reinstall my squid with --no-internal-dns option, and I was hoping to redirect a public ip to an ip in my network.

my /etc/hosts file can understand:
1.2.3.4 fakeweb.whatever
but not:
1.2.3.4 2.3.4.5

What should I do to make /etc/hosts file to understand this?

cyrillic

Falchion · n00b Joined: 18 Dec 2005 Posts: 57

my router also serves as transparent proxy.

iptables can't control the connection coming through squid.... so I have to look for another solution other than separating them(making another router).

is there anyone that know how to patch /etc/hosts file that can help me?

kokoko3k · n00b Joined: 06 May 2005 Posts: 72

/etc/hosts resolves hostnames, not ips, so i guess not.

eccerr0r · Posted: Fri Oct 10, 2008 12:05 am Post subject:

sounds like you have to hack/patch squid to do this, you can't hack /etc/hosts to remap IP addresses.
_________________
Intel Core i7 2700K@ 4.1GHz/HD3000 graphics/8GB DDR3/180GB SSD
What am I supposed watching?

Hu · Moderator Joined: 06 Mar 2007 Posts: 16693

You may be able to use the iptables DNAT target to achieve this. Please post a description of what you are trying to achieve.

Falchion · n00b Joined: 18 Dec 2005 Posts: 57

Hu, DNAT is out of the option unless I add another router between tranparent proxy and WAN....

Iptables have no control whatsoever in bandwidth going directly through the squid if it's all made in one box(the firewall can't tell which packet to filter because the destination is the box itself... and it can't re-rearrange the destination once it leave squid on the other interface).... unless there's a more advanced iptables command that I can use to accomplish this?

I just want to basically redirect connection going through router/squid that leads to 2.3.4.5(WAN) ---> to be directed to 1.2.3.4(LAN).
I tried doing this:
IPTABLES -t NAT -A POSTROUTING -o eth1 -d 2.3.4.5 -j DNAT --to 1.2.3.4
but it return "Invalid Argument."
if I tried PREROUTING.... can't use -o with it.
If I tried -i eth0... it doesn't filter anything because the -d is the box itself :cry:

eccerr0r, can you point me to the right direction of how to patch squid to accomplish this?

Hu · Moderator Joined: 06 Mar 2007 Posts: 16693

DNAT is only valid in the PREROUTING and OUTPUT chains, according to man iptables. Use REDIRECT in the PREROUTING chain to transparently intercept traffic routed through the box and redirect it to the box itself. Use DNAT to redirect an outbound connection from the box.

Your description does not explain how you expect traffic shaping to fit into this, or where you want to accomplish it.

Falchion · n00b Joined: 18 Dec 2005 Posts: 57

Hu · Moderator Joined: 06 Mar 2007 Posts: 16693

It is a little strange to try to transparently intercept a connection, run it through an HTTP proxy, traffic shape it, and transparently redirect the outbound traffic again - whether using one box or several. However, from your description, I do not see anything that I think indicates that it should not work. I have tried each of the pieces individually on various occasions and they work fine.

What is the output of (set -x ; iptables-save -c | nl ; tc -s qdisc show | nl ; tc -s class show | nl ; tc -s filter show| nl)?

Falchion · n00b Joined: 18 Dec 2005 Posts: 57

Hu, just tell me what you have in mind to accomplish this.
I'll work it and let you know if it's working or not.

Seeing my iptables output atm with give you nothing that you needed to know in order to answer my question. Quit wasting both of our time. It's either you have the answer or you don't.

I already told you what I did and the reason why it didn't work. I also told you what I need to accomplish. I think we should stop at it until somebody comes up with the answer other than the one I already know.

think4urs11 · Posted: Mon Oct 13, 2008 12:39 am Post subject:

Already tried to simply set a host route on your squid box for the external ip pointing to your internal webserver?
_________________
Nothing is secure / Security is always a trade-off with usability / Do not assume anything / Trust no-one, nothing / Paranoia is your friend / Think for yourself

Hu · Moderator Joined: 06 Mar 2007 Posts: 16693

Falchion · n00b Joined: 18 Dec 2005 Posts: 57

Ok, I'm so sorry...
I forgot to mention that all my clients are windows base clients... and they all have their proxy set with port 3128 going to my router.

That's why they ignore the rule and went straight to squid. Unfortunately, I have to leave the clients' setting as it is and now I have to look for other solution other than the one we already discussed

Strangely enough, /etc/hosts affects the traffic in this situation, that's why I went straight asking of how to patch /etc/hosts file.

Is there a way maybe for iptables to intercept this traffic if the clients already set that way?

think4urs11 · Posted: Tue Oct 14, 2008 12:31 am Post subject:

Falchion · n00b Joined: 18 Dec 2005 Posts: 57

think4urs11 · Posted: Tue Oct 14, 2008 8:14 pm Post subject:

i mean that you try to set a dedicated route on your squid box to the destination server you want to 'fake'.
Something like route add -host 2.3.4.5 1.2.3.4
Had something similar done some time ago (on cisco equipment though) to provide a smooth transition phase for clients connecting to servers by abandoned ip addresses in our network.

And it makes a difference - in your setup the client browsers expect to work via a dedicated proxy but are then more or less forced to work via a transparent one - not sure if that scenario is really supported by the browsers.
_________________
Nothing is secure / Security is always a trade-off with usability / Do not assume anything / Trust no-one, nothing / Paranoia is your friend / Think for yourself

Falchion · n00b Joined: 18 Dec 2005 Posts: 57

eccerr0r · Posted: Wed Oct 15, 2008 4:13 pm Post subject:

The thing is about using squid is that squid is proxying your requests. So on your squid/router box, you need to route away any packets destined... so the NAT table has nothing to do with what you want to do.

I'm no expert on iptables, but what it sounds like is that you need to muck with your regular routing table, not NAT routing table. Which means that all connections from that box to the rerouted address, whether from squid or not, get rerouted. If you don't want that to happen, you have to hack squid to do IP address translation.
_________________
Intel Core i7 2700K@ 4.1GHz/HD3000 graphics/8GB DDR3/180GB SSD
What am I supposed watching?

Falchion · n00b Joined: 18 Dec 2005 Posts: 57

think4urs11 · Posted: Thu Oct 16, 2008 7:01 am Post subject:

http://wiki.squid-cache.org/SquidFaq/SquidRedirectors
_________________
Nothing is secure / Security is always a trade-off with usability / Do not assume anything / Trust no-one, nothing / Paranoia is your friend / Think for yourself

Falchion · n00b Joined: 18 Dec 2005 Posts: 57