redirect to proxy servere

redirect to proxy servere

[dhottinger]

I currently redirect all port 80 traffic to my squid proxy server with  
following:

$IPC -A TOSERVERS -p tcp --dport 8080 -d 204.111.40.10 -i $L3 -j LACCEPT
$IPC -A TOSERVERS -p tcp --dport 8080 -d 204.111.40.10 -i $L3 -j LACCEPT
$IPC -A TOSERVERS -p tcp --dport 9011:9015 -d 204.111.40.10 -i $L3 -j LACCEPT
$IPC -A TOSERVERS -p tcp --dport 10000 -d 204.111.40.10 -i $L3 -j LACCEPT

Works great, except all of a sudden my apple computers wont do  
software updates.  So, I would like to not redirect traffic that is  
destined for apple.com or swscan.apple.com's website.  Im not quite  
sure of the syntax for my rule, or if this is even possible.  Any ideas?

thanks,

ddh


-- 
Dwayne Hottinger
Network Administrator
Harrisonburg City Public Schools

Re: redirect to proxy servere

[Jan Engelhardt]

On Mar 1 2007 07:19, dhottinger@harrisonburg.k12.va.us wrote:
>
> I currently redirect all port 80 traffic to my squid proxy server with
> following:
>
> $IPC -A TOSERVERS -p tcp --dport 8080 -d 204.111.40.10 -i $L3 -j LACCEPT
> $IPC -A TOSERVERS -p tcp --dport 8080 -d 204.111.40.10 -i $L3 -j LACCEPT
> $IPC -A TOSERVERS -p tcp --dport 9011:9015 -d 204.111.40.10 -i $L3 -j LACCEPT
> $IPC -A TOSERVERS -p tcp --dport 10000 -d 204.111.40.10 -i $L3 -j LACCEPT
>
> Works great, except all of a sudden my apple computers wont do software
> updates.  So, I would like to not redirect traffic that is destined for
> apple.com or swscan.apple.com's website.  Im not quite sure of the syntax for
> my rule, or if this is even possible.  Any ideas?

Perhaps the problem is not in the "TOSERVERS" chain but the "LACCEPT" one.
Or even somewhere else in the iptables ruleset.



Jan
-- 

Re: redirect to proxy servere

[dhottinger]

Same ruleset Ive been using for 3 years with no issues.  I just would  
like to have any traffic going to apples update site go straight there  
without being redirected to my proxy.

thanks,
ddh


Quoting Jan Engelhardt <jengelh@linux01.gwdg.de>:

>
> On Mar 1 2007 07:19, dhottinger@harrisonburg.k12.va.us wrote:
>>
>> I currently redirect all port 80 traffic to my squid proxy server with
>> following:
>>
>> $IPC -A TOSERVERS -p tcp --dport 8080 -d 204.111.40.10 -i $L3 -j LACCEPT
>> $IPC -A TOSERVERS -p tcp --dport 8080 -d 204.111.40.10 -i $L3 -j LACCEPT
>> $IPC -A TOSERVERS -p tcp --dport 9011:9015 -d 204.111.40.10 -i $L3   
>> -j LACCEPT
>> $IPC -A TOSERVERS -p tcp --dport 10000 -d 204.111.40.10 -i $L3 -j LACCEPT
>>
>> Works great, except all of a sudden my apple computers wont do software
>> updates.  So, I would like to not redirect traffic that is destined for
>> apple.com or swscan.apple.com's website.  Im not quite sure of the   
>> syntax for
>> my rule, or if this is even possible.  Any ideas?
>
> Perhaps the problem is not in the "TOSERVERS" chain but the "LACCEPT" one.
> Or even somewhere else in the iptables ruleset.
>
>
>
> Jan
> --
>



-- 
Dwayne Hottinger
Network Administrator
Harrisonburg City Public Schools

Re: redirect to proxy servere

[dhottinger]

Quoting dhottinger@harrisonburg.k12.va.us:

> Same ruleset Ive been using for 3 years with no issues.  I just would
> like to have any traffic going to apples update site go straight there
> without being redirected to my proxy.
>
> thanks,
> ddh
>
>
> Quoting Jan Engelhardt <jengelh@linux01.gwdg.de>:
>
>>
>> On Mar 1 2007 07:19, dhottinger@harrisonburg.k12.va.us wrote:
>>>
>>> I currently redirect all port 80 traffic to my squid proxy server with
>>> following:
>>>
>>> $IPC -A TOSERVERS -p tcp --dport 8080 -d 204.111.40.10 -i $L3 -j LACCEPT
>>> $IPC -A TOSERVERS -p tcp --dport 8080 -d 204.111.40.10 -i $L3 -j LACCEPT
>>> $IPC -A TOSERVERS -p tcp --dport 9011:9015 -d 204.111.40.10 -i $L3  
>>>   -j LACCEPT
>>> $IPC -A TOSERVERS -p tcp --dport 10000 -d 204.111.40.10 -i $L3 -j LACCEPT
>>>
>>> Works great, except all of a sudden my apple computers wont do software
>>> updates.  So, I would like to not redirect traffic that is destined for
>>> apple.com or swscan.apple.com's website.  Im not quite sure of the  
>>>   syntax for
>>> my rule, or if this is even possible.  Any ideas?
>>
>> Perhaps the problem is not in the "TOSERVERS" chain but the "LACCEPT" one.
>> Or even somewhere else in the iptables ruleset.
>>
>>
>>
>> Jan
>> --
>>
>
>
>
> -- 
> Dwayne Hottinger
> Network Administrator
> Harrisonburg City Public Schools

$IPC -N LACCEPT
$IPC -A LACCEPT -j ACCEPT


-- 
Dwayne Hottinger
Network Administrator
Harrisonburg City Public Schools

Re: redirect to proxy servere

[Jan Engelhardt]

On Mar 1 2007 09:09, dhottinger@harrisonburg.k12.va.us wrote:
>> > > 
>> > > $IPC -A TOSERVERS -p tcp --dport 8080 -d 204.111.40.10 -i $L3 -j
>> > > LACCEPT
>> > > $IPC -A TOSERVERS -p tcp --dport 8080 -d 204.111.40.10 -i $L3 -j
>> > > LACCEPT
>> > > $IPC -A TOSERVERS -p tcp --dport 9011:9015 -d 204.111.40.10 -i $L3
>> > > -j LACCEPT
>> > > $IPC -A TOSERVERS -p tcp --dport 10000 -d 204.111.40.10 -i $L3 -j
>> > > LACCEPT

This is just filtering. If you do not want things to be NAT'ed,
do it in the nat table.


Jan
--