Solved

Using PF to rdr all http/https traffic to a web-scanning proxy

Posted on 2006-07-17
8
458 Views
Last Modified: 2013-12-23
I want to redirect all the outgoing traffic on port 80 to force it to go through the proxy held at messagelabs.  At the moment the rdr rule looks like

rdr on $int_if proto tcp from any to any port http -> 216.82.251.227 port 3128

This doesn't work.  I actually am a bit confused by what that does - if the proxy is not in the browser configuration then all pages fail.  If the proxy is in the configuration then it works.

Can anyone suggest how this ought to work with pf on openbsd?
0
Comment
Question by:chemwatch
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
8 Comments
 
LVL 51

Expert Comment

by:ahoffmann
ID: 17131387
sorry I'm not used to pf, but is it a full statefull inspection firewall which handles the way back automatically?
If not you probably need a rule for the packets back from the proxy to your clients.
0
 

Author Comment

by:chemwatch
ID: 17135803
The beauty of a redirect is that there should actually be no need to treat the return path specially.  Redirect will rewrite the destination of each outbound packet to be the web-proxy, but the source of the packet will still be the IP of the nat host that is sending it.
0
 
LVL 51

Expert Comment

by:ahoffmann
ID: 17136212
do you see the requests at your proxy? If so, does it send the response back to the client?
I'd use tcpdump on the proxy host.
0
What is SQL Server and how does it work?

The purpose of this paper is to provide you background on SQL Server. It’s your self-study guide for learning fundamentals. It includes both the history of SQL and its technical basics. Concepts and definitions will form the solid foundation of your future DBA expertise.

 

Author Comment

by:chemwatch
ID: 17136251
We don't house the proxy - it is run by an outsourced company in singapore, to which we have no access.
0
 
LVL 51

Expert Comment

by:ahoffmann
ID: 17136554
ok, then use tcpdump on your firewall, if you see the outgoing packets but no corresponding incomming, then the problem is at the proxy site
0
 
LVL 1

Accepted Solution

by:
robbak earned 250 total points
ID: 17229787
Transparent Proxying - which is what you want to do - should be allowed to talk to the firewall to work out where the request came from. At the very least, it needs to know that it is supposed to be a transparent proxy. In squid, this is a compile-time option.

It seems that the remote proxy is not set up to act as a transparent proxy.

The best option I can see is to run a proxy on the local system. You don't need to give it a large cache - Indeed, none at all will work - and then have it use the other proxy as a parent. If you wish to go this way, then post back and we'll help you.
0

Featured Post

Free Tool: Port Scanner

Check which ports are open to the outside world. Helps make sure that your firewall rules are working as intended.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Meet the world's only “Transparent Cloud™” from Superb Internet Corporation. Now, you can experience firsthand a cloud platform that consistently outperforms Amazon Web Services (AWS), IBM’s Softlayer, and Microsoft’s Azure when it comes to CPU and …
For many of us, the  holiday season kindles the natural urge to give back to our friends, family members and communities. While it's easy for friends to notice the impact of such deeds, understanding the contributions of businesses and enterprises i…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

752 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question