Can you attach or paste\gist the output of:
ip rule
It will help to also see the tables which you use in conjunction to the "ip 
rule" based on the mark.


Eliezer Croitoru
Linux System Administrator
Mobile: +972-5-28704261

-----Original Message-----
From: squid-users [] On Behalf 
Of Walter H.
Sent: Tuesday, August 8, 2017 17:15
Subject: [squid-users] IPv6 and TPROXY


I did at the ip6tables like this:

iptables -t mangle -N DIVERT
iptables -t mangle -A DIVERT -j MARK --set-mark 1
iptables -t mangle -A DIVERT -j ACCEPT

iptables -t mangle -A PREROUTING -i br0 -p tcp -m socket -j DIVERT

iptables -t mangle -A PREROUTING -i br0 -p tcp -d 2a02:1788:2fd::b2ff:5302
--dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-ip ipv6lan --on-port 3129

in squid.conf I added

http_port  ipv6lan:3129 tproxy

I added the following also this rule to ip6tables

iptables -t filter -A INPUT -i br0 -d ipv6lan -m tcp -p tcp --dport 3129
-m state --state NEW -j ACCEPT

when I have tcpdump run, I get this:

16:08:58.452533 IP6 ipv6host.37656 > 2a02:1788:2fd::b2ff:5302.80: Flags
[S], seq 231343061, win 14400, options [mss 1440,sackOK,TS val 1875817945
ecr 0,nop,wscale 5], length 0
16:08:58.452794 IP6 ipv6lan > ipv6host: ICMP6, destination unreachable,
unreachable port, 2a02:1788:2fd::b2ff:5302 tcp port 80, length 88

when doing:

wget -6 --user-agent="Microsoft-CryptoAPI/10.0" --no-proxy

( has IPv6 address 2a02:1788:2fd::b2ff:5302)

what am I missing?


squid-users mailing list

squid-users mailing list

Reply via email to