Mailing-List: contact users-help@trafficserver.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@trafficserver.apache.org
Received-SPF: pass (nike.apache.org: local policy)
Date: Thu, 24 May 2012 06:51:32 -0500
From: "Alan M. Carroll" <amc@network-geographics.com>
Organization: Network Geographics, Inc.
Message-ID: <17510255028.20120524065132@network-geographics.com>
To: Saraswathi Venkataraman <users@trafficserver.apache.org>
Subject: Re: Configuring traffic server on transparent proxy mode.
In-Reply-To: 
 <BB345F600CB1164AB82F077B37194D4317337539@mumEX01.India.XoriantCorp.com>
References: 
 <BB345F600CB1164AB82F077B37194D4317337118@mumEX01.India.XoriantCorp.com>
 <371609216.20120522194054@network-geographics.com>
 <BB345F600CB1164AB82F077B37194D4317337487@mumEX01.India.XoriantCorp.com>
 <94755473.20120523102502@network-geographics.com>
 <BB345F600CB1164AB82F077B37194D4317337539@mumEX01.India.XoriantCorp.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

I would use just server_ports for all port description information. It was put in to do precisely that.

For iptables, a "--set-mark 0x1/0x1 -j ACCEPT" is effectively the same as your DIVERT chain.

I don't use the "-m socket" because once a stream is established normal routing will handle it. My iptables basically has two rules, one for --sport and one for --dport.

Thursday, May 24, 2012, 1:13:20 AM, you wrote:

> Thanks Alan.

> Are there any alternative ways to implement it without redundancy so that I can compare and see what can be re moved? How do you suggest I implement it?

> Thanks & Regards
> Saraswathi Venkataraman | Xoriant Solutions Pvt. Ltd.  
> Winchester, Hiranandani Business Park, Powai, Mumbai 400076, INDIA. 
> Tel: +91 22 30511000 | Ext: 1113 | http://www.xoriant.com


> -----Original Message-----
> From: Alan M. Carroll [mailto:amc@network-geographics.com] 
> Sent: Wednesday, May 23, 2012 8:55 PM
> To: Saraswathi Venkataraman
> Subject: Re: Configuring traffic server on transparent proxy mode.

> The use of server_port and server_other_ports is deprecated. You should use server_ports only, with "8080:tr-full". However the change was made so that those options should still work, although they will be removed in a future release. You should not under any circumstances use both server_port&server_other_ports and server_ports, that can cause port conflicts.

> You are marking packets and using routing table 100. Do you define rules for table 100? Also, it looks like your divert chain marks packets the same way as your --dport rule. But if it works, then it's correct.

> Wednesday, May 23, 2012, 8:18:24 AM, you wrote:

>> Finally resolved it this way: It got configured on tproxy mode