Nathan Fowler <[EMAIL PROTECTED]> wrote:
>
> I want to forward all http traffic on my internal masq'd lan to the
> proxy so each client machine doesn't have to be configured to use
> @home's proxy so the linux masq machine would take care of the
> cascaded server.
Masq can't really do that. It can only modify IP addresses as they pass
in and out of your machine.
The main problem you're going to have is that the HTTP protocol is
different, depending on whether you are going straight to the target
host, or through a proxy.
> Rule I'm using: /sbin/ipfwadm -F -P tcp -a m -S 192.168.0.1/24 80 -D
> 24.2.19.15/32 8080
That's not going to work. It says to masquerade traffic, if the source
port is 80 on your local net, and the destination is port 8080 on the
proxy machine. This is a highly unlikely rule to trigger, because your
web client always uses a random source port between 1024 and 60000;
never port 80. If you add the "-o" switch to cause the rule to be
logged, you'll see that it never logs.
> The problem I have is that it isn't forwarding the http requests to
> 24.2.19.15 like it should be.
Forwarding is determined by route tables. Not firewall rules.
Maybe you already knew this stuff, but I seem to need to repeat it a
lot. So I am. :)
> If I configure each client machine separately it works great (the
> speed advantage due to cache on 24.2.19.15 is noticable).
You may really wish to consider reconfiguring your clients in this
manner, if they are always going to be connected to this network. The
reason is that it allows your web clients to skip the DNS lookup, and
simply submit the entire URL to the caching proxy. It can do the DNS
lookup itself, if it wants to, or simply return the cached data. But
your clients will be able to save valuable time in any case.
> I have really no idea what other rule I should be using, your advice
> is most appreciated.
If you still want to persue the idea, you may wish to examine
transparent proxying. In fact, the "tproxyd" that comes with Squid
might be just what you need to pull this off.
Nevertheless, an auto-configuring web browser (using a Javascript
autoconfig script that you supply from a central source) might be easier
and faster in the long run.
--
[EMAIL PROTECTED] (Fuzzy Fox) || "Nothing takes the taste out of peanut
sometimes known as David DeSimone || butter quite like unrequited love."
http://www.dallas.net/~fox/ || -- Charlie Brown
_______________________________________________
Masq maillist - [EMAIL PROTECTED]
http://tiffany.indyramp.com/mailman/listinfo/masq
Admin requests can be handled by web (above) or [EMAIL PROTECTED]
