On 10/08/2011 19:30, Tom Eastep wrote: > It is my understanding that the latest versions of Squid preserve packet > marks; I haven't tested it. If that is the case, then doing all proxy on > host1 would be a solution.
It's a feature of Squid 3.2, which is nominally somewhere between alpha and beta quality right now. The patch is fairly sane though and someone who cared could probably easily retrofit it to squid 3.1? Note it's a compile time option Basically it copies (I think?) the connection mark from the input side, to the output packet mark on the output side (please check connection/packet mark assumptions...). Remember neither of these marks exists outside of the box they are set on... If you want to do this on something other than host1, then you will need to think of some way to mark the tcp packet to show host1 how to route it... Alternatively find some other way to auth (captive portal type auth?) and use tproxy? Just an FYI, but dnsmasq latest version has/will acquire the same packet mark copying in the next version (probably due out any day now). Once you start thinking about this, you realise you can do some interesting things to track stuff through "proxies" Good luck Ed W ------------------------------------------------------------------------------ uberSVN's rich system and user administration capabilities and model configuration take the hassle out of deploying and managing Subversion and the tools developers use with it. Learn more about uberSVN and get a free download at: http://p.sf.net/sfu/wandisco-dev2dev _______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
