Mailing-List: contact users-help@trafficserver.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@trafficserver.apache.org
Received-SPF: pass (athena.apache.org: domain of weilogster@gmail.com
 designates 209.85.216.170 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:date:message-id:subject:from:to:content-type;
        b=c/G+ViZaBOxIBtUqgUDKs24uNJrNpmK+QbzBY1ubp/prT2HPIx+mt2PXSZHFOWImRJ
         4GgD1C1eQfejCmxdHBweuAxusYVVEXRfp59/BfmiD2bZrWVAeMhsnsTa+z+Qk7KZiX/G
         yoE8BjL+1I1ovu4B3ngAaeTGbRkT2o3+vM/DQ=
MIME-Version: 1.0
Date: Sun, 26 Sep 2010 16:48:53 +0800
Message-ID: <AANLkTimAoSrqQsN8Hbb8jqMi6_v7GQfg+r8D7XUC1jB6@mail.gmail.com>
Subject: transparent proxy with TS2.3.1-unstable
From: =?GB2312?B?zrq9+g==?= <weilogster@gmail.com>
To: trafficserver groups <users@trafficserver.apache.org>
Content-Type: multipart/alternative; boundary=0015175cb0c46f5f63049125aecd

--0015175cb0c46f5f63049125aecd
Content-Type: text/plain; charset=ISO-8859-1

hi
I want to set up a transparent proxy server with ts2.3.1,  but  the
following error happens:
ERROR: [bindProxyPort] Unable to set transparent socket option [92] Protocol
not available
can anybody help me? Thanks

record.conf:
CONFIG proxy.config.http.server_port_attr STRING =
CONFIG proxy.config.cluster.ethernet_interface STRING eth1

The server has two network interfaces, eth0 (LAN), eth1(INTERNET), and the
OS system is CentOS5.4. And I connected the server(eth0) and client with one
a network cable.
The following is our iptables rules:
#!/bin/sh
#
------------------------------------------------------------------------------------
# See URL:
http://www.cyberciti.biz/tips/linux-setup-transparent-proxy-squid-howto.html
# (c) 2006, nixCraft under GNU/GPL v2.0+
#
-------------------------------------------------------------------------------------
# TRAFFIC server IP
TRAFFIC_SERVER="192.168.8.131"
# Interface connected to Internet
INTERNET="eth1"
# Interface connected to LAN
LAN_IN="eth0"
# Traffic Server port
TS_PORT="8080"

# DO NOT MODIFY BELOW
# Clean old firewall
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
# Load IPTABLES modules for NAT and IP conntrack support
modprobe ip_conntrack
modprobe ip_conntrack_ftp
# For win xp ftp client
#modprobe ip_nat_ftp
echo 1 > /proc/sys/net/ipv4/ip_forward
# Setting default filter policy
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
# Unlimited access to loop back
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
# Allow UDP, DNS and Passive FTP
iptables -A INPUT -i $INTERNET -m state --state ESTABLISHED,RELATED -j
ACCEPT
# set this system as a router for Rest of LAN
iptables --table nat --append POSTROUTING --out-interface $INTERNET -j
MASQUERADE
iptables --append FORWARD --in-interface $LAN_IN -j ACCEPT
# unlimited access to LAN
iptables -A INPUT -i $LAN_IN -j ACCEPT
iptables -A OUTPUT -o $LAN_IN -j ACCEPT
# DNAT port 80 request comming from LAN systems to ts 8080 ($TS_PORT) aka
transparent proxy
iptables -t nat -A PREROUTING -i $LAN_IN -p tcp --dport 80 -j DNAT --to
$TRAFFIC_SERVER:$TS_PORT
# if it is same system
iptables -t nat -A PREROUTING -i $INTERNET -p tcp --dport 80 -j REDIRECT
--to-port $TS_PORT
# DROP everything and Log it
iptables -A INPUT -j LOG
iptables -A INPUT -j DROP

--0015175cb0c46f5f63049125aecd
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

hi<br>
I want to set up a transparent proxy server with ts2.3.1, =A0but =A0the<br>
following error happens:<br>
ERROR: [bindProxyPort] Unable to set transparent socket option [92] Protoco=
l<br>
not available<br>
can anybody help me? Thanks<br>
<br>
record.conf:<br>
CONFIG proxy.config.http.server_port_attr STRING =3D<br><div id=3D":5y">
CONFIG proxy.config.cluster.ethernet_interface STRING eth1<br>
<br>
The server has two network interfaces, eth0 (LAN), eth1(INTERNET), and the<=
br>
OS system is CentOS5.4. And I connected the server(eth0) and client with on=
e<br>
a network cable.<br>
The following is our iptables rules:<br>
#!/bin/sh<br>
#<br>
---------------------------------------------------------------------------=
---------<br>
# See URL:<br>
<a href=3D"http://www.cyberciti.biz/tips/linux-setup-transparent-proxy-squi=
d-howto.html" target=3D"_blank">http://www.cyberciti.biz/tips/linux-setup-t=
ransparent-proxy-squid-howto.html</a><br>
# (c) 2006, nixCraft under GNU/GPL v2.0+<br>
#<br>
---------------------------------------------------------------------------=
----------<br>
# TRAFFIC server IP<br>
TRAFFIC_SERVER=3D&quot;192.168.8.131&quot;<br>
# Interface connected to Internet<br>
INTERNET=3D&quot;eth1&quot;<br>
# Interface connected to LAN<br>
LAN_IN=3D&quot;eth0&quot;<br>
# Traffic Server port<br>
TS_PORT=3D&quot;8080&quot;<br>
<br>
# DO NOT MODIFY BELOW<br>
# Clean old firewall<br>
iptables -F<br>
iptables -X<br>
iptables -t nat -F<br>
iptables -t nat -X<br>
iptables -t mangle -F<br>
iptables -t mangle -X<br>
# Load IPTABLES modules for NAT and IP conntrack support<br>
modprobe ip_conntrack<br>
modprobe ip_conntrack_ftp<br>
# For win xp ftp client<br>
#modprobe ip_nat_ftp<br>
echo 1 &gt; /proc/sys/net/ipv4/ip_forward<br>
# Setting default filter policy<br>
iptables -P INPUT DROP<br>
iptables -P OUTPUT ACCEPT<br>
# Unlimited access to loop back<br>
iptables -A INPUT -i lo -j ACCEPT<br>
iptables -A OUTPUT -o lo -j ACCEPT<br>
# Allow UDP, DNS and Passive FTP<br>
iptables -A INPUT -i $INTERNET -m state --state ESTABLISHED,RELATED -j<br>
ACCEPT<br>
# set this system as a router for Rest of LAN<br>
iptables --table nat --append POSTROUTING --out-interface $INTERNET -j<br>
MASQUERADE<br>
iptables --append FORWARD --in-interface $LAN_IN -j ACCEPT<br>
# unlimited access to LAN<br>
iptables -A INPUT -i $LAN_IN -j ACCEPT<br>
iptables -A OUTPUT -o $LAN_IN -j ACCEPT<br>
# DNAT port 80 request comming from LAN systems to ts 8080 ($TS_PORT) aka<b=
r>
transparent proxy<br>
iptables -t nat -A PREROUTING -i $LAN_IN -p tcp --dport 80 -j DNAT --to<br>
$TRAFFIC_SERVER:$TS_PORT<br>
# if it is same system<br>
iptables -t nat -A PREROUTING -i $INTERNET -p tcp --dport 80 -j REDIRECT<br=
>
--to-port $TS_PORT<br>
# DROP everything and Log it<br>
iptables -A INPUT -j LOG<br>
iptables -A INPUT -j DROP</div>

--0015175cb0c46f5f63049125aecd--