Using PF to rdr all http/https traffic to a web-scanning proxy

I want to redirect all the outgoing traffic on port 80 to force it to go through the proxy held at messagelabs.  At the moment the rdr rule looks like

rdr on $int_if proto tcp from any to any port http -> 216.82.251.227 port 3128

This doesn't work.  I actually am a bit confused by what that does - if the proxy is not in the browser configuration then all pages fail.  If the proxy is in the configuration then it works.

Can anyone suggest how this ought to work with pf on openbsd?
chemwatchAsked:
Who is Participating?
 
robbakConnect With a Mentor Commented:
Transparent Proxying - which is what you want to do - should be allowed to talk to the firewall to work out where the request came from. At the very least, it needs to know that it is supposed to be a transparent proxy. In squid, this is a compile-time option.

It seems that the remote proxy is not set up to act as a transparent proxy.

The best option I can see is to run a proxy on the local system. You don't need to give it a large cache - Indeed, none at all will work - and then have it use the other proxy as a parent. If you wish to go this way, then post back and we'll help you.
0
 
ahoffmannCommented:
sorry I'm not used to pf, but is it a full statefull inspection firewall which handles the way back automatically?
If not you probably need a rule for the packets back from the proxy to your clients.
0
 
chemwatchAuthor Commented:
The beauty of a redirect is that there should actually be no need to treat the return path specially.  Redirect will rewrite the destination of each outbound packet to be the web-proxy, but the source of the packet will still be the IP of the nat host that is sending it.
0
Improve Your Query Performance Tuning

In this FREE six-day email course, you'll learn from Janis Griffin, Database Performance Evangelist. She'll teach 12 steps that you can use to optimize your queries as much as possible and see measurable results in your work. Get started today!

 
ahoffmannCommented:
do you see the requests at your proxy? If so, does it send the response back to the client?
I'd use tcpdump on the proxy host.
0
 
chemwatchAuthor Commented:
We don't house the proxy - it is run by an outsourced company in singapore, to which we have no access.
0
 
ahoffmannCommented:
ok, then use tcpdump on your firewall, if you see the outgoing packets but no corresponding incomming, then the problem is at the proxy site
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.