Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Marked this as answered. I'm going to pass on trying to get this to work. It was only for testing.

I'm currently using a proxy server (squid) that's listening on port 8080. Users' browsers are configured with this proxy.

I would like to test another proxy device without having to reconfigure anything on the users' workstations.

The new box requires using it as the default gateway. It transparently filters for viruses and content.

Is there a way to redirect traffic destined for port 8080 on the current proxy to the new box without performing NAT? I would like the source IP addresses to remain the same so we can see who's accessing what.

I've tried a few things with IPTABLES but had no luck. Any ideas would be appreciated.

Thanks, Rod

share|improve this question
I am confused by "Is there a way to redirect traffic ... without performing NAT?" and "I've tried a few things with IPTABLES..." What have you tried with iptables? NAT is in most cases the most straightforward way of redirecting traffic destined for one machine to another one. What are your reasons for avoiding NAT? Can the new device be configured as an explicit proxy? Many devices like from Check Point and Fortinet can be configured this way. Does the new device recognize the X-Forwarded-For header? – pabouk Oct 16 '13 at 15:28
Thanks for the reply. I would like the traffic source IP addresses to remain the same. If the addresses are being translated, the only IP I will see on the new device will be the PROXY IP. – Rod Oct 16 '13 at 15:37
I'll look into setting the new device up as an explicit proxy. – Rod Oct 16 '13 at 15:40
When you add what is your new device capable of (or directly say what is it) I will be able to add more details to my reply. It is better to edit the question to make it more clear and precise (to make it better). You will have a greater chance of getting a reply. – pabouk Oct 16 '13 at 16:50
up vote 0 down vote accepted

I can imagine 4 basic options how to achieve your goal. They are listed as two variants each with two sub-variants.

  1. Configure the new device as an explicit HTTP proxy. Of course the new device must have this possibility. For example Fortinet and Check Point firewalls are capable of this.
    1. On the Squid proxy set the new device as an up-stream proxy. The new device will see only the address of the Squid proxy. It must be capable of interpreting the X-Forwarded-For HTTP header to be able to see the IP addresses of the clients.
    2. Between the clients and the new device perform NAT of the destination address (and port if needed). So that instead of Squid IP : 8080 the packets would go to the new device IP. The source IP addresses will be the same.
  2. Put the new device in the path between the Squid and the Internet. The device will not act as an explicit HTTP proxy.
    1. The HTTP requests will come from the IP address of the Squid but if the new device understands the X-Forwarded-For HTTP header it will be able to see the IP addresses of the clients.
    2. This is rather a theoretical possibility I am not sure if there is an existing working solution capable of this. Between the Squid and the new device perform source IP address NAT back to the IP addresses of the clients so the requests going from the Squid to the Internet will look like requests going directly from the clients.
share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .