iptable and redirect

[l_linuxguru]

iptables -t nat -A PREROUTING -p tcp -s 192.168.0.0/16 --dport 80 -j REDIRECT --to-port 3128
ihave added this rule to redirect all my http request to port 3128 but its not working.
plz help.

[wassy121]

that probably does exactly what you told it to:

iptables -t nat

will add this rule to the "nat" table

-A PREROUTING -p tcp -s 192.168.0.0/16

will make this rule happen before it is routed through the box, and will act on all TCP requests that come from 192.168.0.0/16 (which is your internal network)

--dport 80 -j REDIRECT --to-port 3128

will assure that packets going to port 80 of the destination will redirect to port 3128.

So you are saying that when an internal client (like the computer you type at) tries to go to "hotmail.com" it is redirected to "hotmail.com:3128". Is this what you want?

[l_linuxguru]

that probably does exactly what you told it to:

iptables -t nat

will add this rule to the "nat" table

-A PREROUTING -p tcp -s 192.168.0.0/16

will make this rule happen before it is routed through the box, and will act on all TCP requests that come from 192.168.0.0/16 (which is your internal network)

--dport 80 -j REDIRECT --to-port 3128

will assure that packets going to port 80 of the destination will redirect to port 3128.

So you are saying that when an internal client (like the computer you type at) tries to go to "hotmail.com" it is redirected to "hotmail.com:3128". Is this what you want?

my proxy server add is 192.168.23.1(internal) iwant all the client request to redirect to it on port 3128.

[Dolda2000]

So you are saying that when an internal client (like the computer you type at) tries to go to "hotmail.com" it is redirected to "hotmail.com:3128". Is this what you want?

I think you've misunderstood the REDIRECT target, wassy. It redirects the port _and_ destination address. It's just that the address is changed to that of the interface that the packet came in through, so in that way it should work.

Download ethereal (if it's not already installed) and check some test traffic to see what's wrong. Also, how doesn't it work? Does it have no effect at all (like the client fetching the content directly from hotmail.com) or does the client fail to connect?