Re: Transparent Squid 2.5Stable10 + FreeBSD 5.4

From: fooler (fooler_at_skyinet.net)
Date: 06/23/05

  • Next message: Darren Pilgrim: "RE: www user than root" 
    To: <freebsd-net@freebsd.org>, "Ryan Rathje " <mrsharky@iastate.edu>
Date: Thu, 23 Jun 2005 10:57:23 +0800

    ----- Original Message -----
    From: "Ryan Rathje " <mrsharky@iastate.edu>
    To: <freebsd-net@freebsd.org>
    Sent: Wednesday, June 22, 2005 9:33 PM
    Subject: Transparent Squid 2.5Stable10 + FreeBSD 5.4

    > Fooler,
    > Thanks for the suggestion thus far, it did clear some up. When I use
    your
    > suggestion of:
    >
    > ipfw add fwd 127.0.0.1,3128 tcp from any to any 80 in via em0
    >
    > 1 FreeBSD configured as a gateway with 2 nics
    > sis0 - outside world nic
    > em0 - internal network nic
    >
    > it appears to have some communication, but not all. Here's what I mean:
    This
    > is the output from ethereal when trying to visit the google website:
    >
    > 192.168.1.5 -> 216.239.39.99 TCP 3694 > http [SYN] seq=0 ack=0 win=16384
    > Len=0 MSS=1460
    > 216.239.39.99 -> 192.168.1.5 TCP http > 3694 [SYN, ACK] seq=0 ack=1
    > win=16384 Len=0 MSS=1460
    > 192.168.1.5 -> 216.239.39.99 TCP 3694 > http [ACK] seq=1 ack=1 win=17520
    > Len=0
    > 192.168.1.5 -> 216.239.39.99 HTTP GET / HTTP/1.1
    > 216.239.39.99 -> 192.168.1.5 TCP http > 3694 [FIN, ACK] seq=1 ack=300
    > win=65535 Len=0
    > 192.168.1.5 -> 216.239.39.99 TCP 3694 > http [ACK] seq=300 ack=2
    win=17520
    > Len=0
    > 192.168.1.5 -> 216.239.39.99 TCP 3694 > http [FIN, ACK] seq=300 ack=2
    > win=17520 Len=0
    > 216.239.39.99 -> 192.168.1.5 TCP http > 3694 [ACK] seq=2 ack=301
    win=65534
    > Len=0

    first... there is no transparent proxy (or http hijacking) took place
    because your client (192.168.1.5) is the one who fetch the google website
    instead your proxy server...

    second... although client is successfully communicate with google web
    server.. it is clearly a violation of RFC 1918.. where it says that the
    private ip address is only routable within your controlled domain.. .once it
    gets out from your controlled domain.. it must be drop... (disregard this
    statement if you do NAT where ethereal interpret the packets above after the
    network address translation)

    show me what "ipfw show" and "netstat -an|grep LISTEN" say...

    fooler.

    _______________________________________________
    freebsd-net@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-net
    To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org"

  • Next message: Darren Pilgrim: "RE: www user than root"