extern/shorewall_code
1
0
Fork 1
mirror of https://gitlab.com/shorewall/code.git synced 2025-08-16 11:44:28 +02:00
Code Issues Packages Projects Releases Wiki Activity

Deprecate the current TPROXY implementation.

Browse Source 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
This commit is contained in:
Tom Eastep
2012-05-10 11:02:08 -07:00
parent 865078f925
commit 6e5b07c804
3 changed files with 0 additions and 102 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
Shorewall/manpages/shorewall-tcrules.xml
View File

@ -407,39 +407,6 @@ SAME $FW 0.0.0.0/0 tcp 80,443</programlisting>
classes will have a value &gt; 256.</para>
</listitem>
<listitem>
<para><emphasis
role="bold">TPROXY</emphasis>(<replaceable>mark</replaceable>[/<replaceable>mask</replaceable>][,[<replaceable>port</replaceable>][,[<replaceable>address</replaceable>]]])</para>
<para>Transparently redirects a packet without altering the IP
header. Requires a local provider to be defined in <ulink
url="shorewall-providers.html">shorewall-providers</ulink>(5).</para>
<para>There are three parameters to TPROXY - only the first
(mark) is required:</para>
<itemizedlist>
<listitem>
<para><replaceable>mark</replaceable> - the MARK value
corresponding to the local provider in <ulink
url="shorewall-providers.html">shorewall-providers</ulink>(5).</para>
</listitem>
<listitem>
<para><replaceable>port</replaceable> - the port on which
the proxy server is listening. If omitted, the original
destination port.</para>
</listitem>
<listitem>
<para><replaceable>address</replaceable> - a local (to the
firewall) IP address on which the proxy server is listening.
If omitted, the IP address of the interface on which the
request arrives.</para>
</listitem>
</itemizedlist>
</listitem>
<listitem>
<para><emphasis role="bold">TTL</emphasis>([<emphasis
role="bold">-</emphasis>|<emphasis

33
Shorewall6/manpages/shorewall6-tcrules.xml
View File

@ -304,39 +304,6 @@ SAME $FW 0.0.0.0/0 tcp 80,443</programlisting>
simply include COMMENT on a line by itself.</para>
</listitem>
<listitem>
<para><emphasis
role="bold">TPROXY</emphasis>(<replaceable>mark</replaceable>[/<replaceable>mask</replaceable>][,[<replaceable>port</replaceable>][,[<replaceable>address</replaceable>]]])</para>
<para>Transparently redirects a packet without altering the IP
header. Requires a local provider to be defined in <ulink
url="shorewall6-providers.html">shorewall6-providers</ulink>(5).</para>
<para>There are three parameters to TPROXY - only the first
(mark) is required:</para>
<itemizedlist>
<listitem>
<para><replaceable>mark</replaceable> - the MARK value
corresponding to the local provider in <ulink
url="shorewall6-providers.html">shorewall6-providers</ulink>(5).</para>
</listitem>
<listitem>
<para><replaceable>port</replaceable> - the port on which
the proxy server is listening. If omitted, the original
destination port.</para>
</listitem>
<listitem>
<para><replaceable>address</replaceable> - a local (to the
firewall) IP address on which the proxy server is listening.
If omitted, the IP address of the interface on which the
request arrives.</para>
</listitem>
</itemizedlist>
</listitem>
<listitem>
<para><emphasis role="bold">HL</emphasis>([<emphasis
role="bold">-</emphasis>|<emphasis

36
docs/Shorewall_Squid_Usage.xml
View File

@ -308,40 +308,4 @@ ACCEPT loc $FW tcp 8080
ACCEPT $FW net tcp 80,443</programlisting></para>
</example>
</section>
<section id="TPROXY">
<title>Transparent with TPROXY</title>
<para>Shorewall 4.4.7 contains support for TPROXY. TPROXY differs from
REDIRECT in that it does not modify the IP header. Because the IP header
stays intact, TPROXY requires policy routing to direct the packets to the
proxy server running on the firewall. This approach requires TPROXY
support in your kernel and iptables and Squid 3. See <ulink
url="http://wiki.squid-cache.org/Features/Tproxy4">http://wiki.squid-cache.org/Features/Tproxy4</ulink>.</para>
<para>The following configuration works with Squid running on the firewall
itself (assume that Squid is listening on port 3128).</para>
<para><filename>/etc/shorewall/interfaces:</filename></para>
<programlisting>#ZONE INTERFACE BROADCAST OPTIONS
- lo - -</programlisting>
<para><filename>/etc/shorewall/providers</filename>:</para>
<programlisting>#NAME NUMBER MARK DUPLICATE INTERFACE GATEWAY OPTIONS COPY
Tproxy 1 1 - lo - local</programlisting>
<para><filename>/etc/shorewall/tcrules</filename> (assume loc interface is
eth1):</para>
<programlisting>MARK SOURCE DEST PROTO PORT(S)
TPROXY(1,3128) eth1 0.0.0.0/0 tcp 80</programlisting>
<para>/etc/shorewall/rules:</para>
<programlisting>#ACTION SOURCE DEST PROTO DEST PORT(S)
ACCEPT loc $FW tcp 80
ACCEPT $FW net tcp 80</programlisting>
</section>
</article>