transperent squid + iptables

zdraveiete
imam sledniq problem sys squid proxy:
izpolzvam iptables ot tipa:
/sbin/iptables -t nat -A PREROUTING -i eth0 -s ! 213.145.122.2 -p tcp --dport 80 -j DNAT --to 213.145.122.2:8080
/sbin/iptables -t nat -A POSTROUTING -o eth0 -s 213.145.122.0/24 -d 213.145.122.2 -j SNAT --to 213.145.122.1
kydeto 213.145.122.1 e iptables box-a, i gateway. a 213.145.122.2 e squid-a
mashinata e gateway na 3 mreji (213.145.122.0/24, 213.145.123.0/24 i 213.145.124.0/24) i v sluchaq iptables mi nat-va celiq web potok ot trite mreji kym squid-a, i mashinata se zaduhva..
v sluchaq iskam da se nat-va samo potoka ot/kum 213.145.122.0/24, a ostanalite mreji da ne polzvat squid-a
nqkoi ideq kak da go napravq s iiptables?

the lord of destruction

ми вместо да пишеш 'всичко различно от 213.145.122.2' напиши кое искаш да нат-ваш
т.е.
iptables .................. -s 213.145.122.0/24 ..................

и орежи другите ип-та от проксито (някой да не се пише на хитър и да си въведе такава настройка в браузъра)

TANSTAAFL! There AiNt Such Thing As A Free Lunch

Az go pravq taka:
Na gate-a:
#Markirane na web trafika
iptables -A PREROUTING -i eth0 -t mangle -p tcp -s 213.145.122.0/24 --dport 80 -j MARK --set-mark 1
#spirane na ICMP redirektvaneto
echo 0 > /proc/sys/net/ipv4/conf/all/send_redirects
echo 0 > /proc/sys/net/ipv4/conf/default/send_redirects
echo 0 > /proc/sys/net/ipv4/conf/eth0/send_redirects
#Policy routing
ip rule add fwmark 1 table [линк]
ip route add default via 213.145.122.2 dev eth0 table [линк]
ip route flush cache

#na squid-a:
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080


Tolkoz
[линк]

Sunwind tfa ne mi varshi rabota, az iskah da puskam prez squida samo "1" mreja
onzi: blagodarq, veche se opravih: pipnah malko routes v mashinata deto e squid-a, mahnah SNAT-a ot gateway-a, i "segmentirah" vyprosnata mreja... ostavih ip-tata ot 1 do 8 "ne-natnati" i vsichko e nared
vse pak vi blagodarq za pomoshtta momcheta :>>
<btw s ip route add default via nqmashe kak da stane, shoto zakacham ethernet interface na gateway-a direktno kym fast ethernet if-a na router:))>

the lord of destruction

mi batka slagash "-s 213.145.122.0/24"