forked from extern/shorewall_code
Compare commits
3 Commits
5.0.13
...
4.5.3-base
| Author | SHA1 | Date | |
|---|---|---|---|
|
746a363d41 | ||
|
|
6e5b07c804 | ||
|
|
865078f925 |
@@ -1030,7 +1030,9 @@ sub normalize_hex( $ ) {
|
||||
# Return the argument expressed in Hex
|
||||
#
|
||||
sub in_hex( $ ) {
|
||||
sprintf '0x%x', $_[0];
|
||||
my $value = $_[0];
|
||||
|
||||
$value =~ /^0x/ ? $value : sprintf '0x%x', $_[0];
|
||||
}
|
||||
|
||||
sub in_hex2( $ ) {
|
||||
|
||||
@@ -632,12 +632,13 @@ CEOF
|
||||
setup_interface_proc( $interface );
|
||||
|
||||
if ( $mark ne '-' ) {
|
||||
my $hexmark = in_hex( $mark );
|
||||
my $mask = have_capability 'FWMARK_RT_MASK' ? '/' . in_hex $globals{PROVIDER_MASK} : '';
|
||||
|
||||
emit ( "qt \$IP -$family rule del fwmark ${mark}${mask}" ) if $config{DELETE_THEN_ADD};
|
||||
emit ( "qt \$IP -$family rule del fwmark ${hexmark}${mask}" ) if $config{DELETE_THEN_ADD};
|
||||
|
||||
emit ( "run_ip rule add fwmark ${mark}${mask} pref $pref table $number",
|
||||
"echo \"qt \$IP -$family rule del fwmark ${mark}${mask}\" >> \${VARDIR}/undo_${table}_routing"
|
||||
emit ( "run_ip rule add fwmark ${hexmark}${mask} pref $pref table $number",
|
||||
"echo \"qt \$IP -$family rule del fwmark ${hexmark}${mask}\" >> \${VARDIR}/undo_${table}_routing"
|
||||
);
|
||||
}
|
||||
|
||||
|
||||
@@ -407,39 +407,6 @@ SAME $FW 0.0.0.0/0 tcp 80,443</programlisting>
|
||||
classes will have a value > 256.</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para><emphasis
|
||||
role="bold">TPROXY</emphasis>(<replaceable>mark</replaceable>[/<replaceable>mask</replaceable>][,[<replaceable>port</replaceable>][,[<replaceable>address</replaceable>]]])</para>
|
||||
|
||||
<para>Transparently redirects a packet without altering the IP
|
||||
header. Requires a local provider to be defined in <ulink
|
||||
url="shorewall-providers.html">shorewall-providers</ulink>(5).</para>
|
||||
|
||||
<para>There are three parameters to TPROXY - only the first
|
||||
(mark) is required:</para>
|
||||
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
<para><replaceable>mark</replaceable> - the MARK value
|
||||
corresponding to the local provider in <ulink
|
||||
url="shorewall-providers.html">shorewall-providers</ulink>(5).</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para><replaceable>port</replaceable> - the port on which
|
||||
the proxy server is listening. If omitted, the original
|
||||
destination port.</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para><replaceable>address</replaceable> - a local (to the
|
||||
firewall) IP address on which the proxy server is listening.
|
||||
If omitted, the IP address of the interface on which the
|
||||
request arrives.</para>
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para><emphasis role="bold">TTL</emphasis>([<emphasis
|
||||
role="bold">-</emphasis>|<emphasis
|
||||
|
||||
@@ -304,39 +304,6 @@ SAME $FW 0.0.0.0/0 tcp 80,443</programlisting>
|
||||
simply include COMMENT on a line by itself.</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para><emphasis
|
||||
role="bold">TPROXY</emphasis>(<replaceable>mark</replaceable>[/<replaceable>mask</replaceable>][,[<replaceable>port</replaceable>][,[<replaceable>address</replaceable>]]])</para>
|
||||
|
||||
<para>Transparently redirects a packet without altering the IP
|
||||
header. Requires a local provider to be defined in <ulink
|
||||
url="shorewall6-providers.html">shorewall6-providers</ulink>(5).</para>
|
||||
|
||||
<para>There are three parameters to TPROXY - only the first
|
||||
(mark) is required:</para>
|
||||
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
<para><replaceable>mark</replaceable> - the MARK value
|
||||
corresponding to the local provider in <ulink
|
||||
url="shorewall6-providers.html">shorewall6-providers</ulink>(5).</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para><replaceable>port</replaceable> - the port on which
|
||||
the proxy server is listening. If omitted, the original
|
||||
destination port.</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para><replaceable>address</replaceable> - a local (to the
|
||||
firewall) IP address on which the proxy server is listening.
|
||||
If omitted, the IP address of the interface on which the
|
||||
request arrives.</para>
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para><emphasis role="bold">HL</emphasis>([<emphasis
|
||||
role="bold">-</emphasis>|<emphasis
|
||||
|
||||
@@ -308,40 +308,4 @@ ACCEPT loc $FW tcp 8080
|
||||
ACCEPT $FW net tcp 80,443</programlisting></para>
|
||||
</example>
|
||||
</section>
|
||||
|
||||
<section id="TPROXY">
|
||||
<title>Transparent with TPROXY</title>
|
||||
|
||||
<para>Shorewall 4.4.7 contains support for TPROXY. TPROXY differs from
|
||||
REDIRECT in that it does not modify the IP header. Because the IP header
|
||||
stays intact, TPROXY requires policy routing to direct the packets to the
|
||||
proxy server running on the firewall. This approach requires TPROXY
|
||||
support in your kernel and iptables and Squid 3. See <ulink
|
||||
url="http://wiki.squid-cache.org/Features/Tproxy4">http://wiki.squid-cache.org/Features/Tproxy4</ulink>.</para>
|
||||
|
||||
<para>The following configuration works with Squid running on the firewall
|
||||
itself (assume that Squid is listening on port 3128).</para>
|
||||
|
||||
<para><filename>/etc/shorewall/interfaces:</filename></para>
|
||||
|
||||
<programlisting>#ZONE INTERFACE BROADCAST OPTIONS
|
||||
- lo - -</programlisting>
|
||||
|
||||
<para><filename>/etc/shorewall/providers</filename>:</para>
|
||||
|
||||
<programlisting>#NAME NUMBER MARK DUPLICATE INTERFACE GATEWAY OPTIONS COPY
|
||||
Tproxy 1 1 - lo - local</programlisting>
|
||||
|
||||
<para><filename>/etc/shorewall/tcrules</filename> (assume loc interface is
|
||||
eth1):</para>
|
||||
|
||||
<programlisting>MARK SOURCE DEST PROTO PORT(S)
|
||||
TPROXY(1,3128) eth1 0.0.0.0/0 tcp 80</programlisting>
|
||||
|
||||
<para>/etc/shorewall/rules:</para>
|
||||
|
||||
<programlisting>#ACTION SOURCE DEST PROTO DEST PORT(S)
|
||||
ACCEPT loc $FW tcp 80
|
||||
ACCEPT $FW net tcp 80</programlisting>
|
||||
</section>
|
||||
</article>
|
||||
|
||||
Reference in New Issue
Block a user