Redirecting _outgoing_ packets to internal services

Hello,

Im currently running a freebsd box to NAT an adsl connection throughout our home network. The internet interface is named tun0, while the internal interface is named rl0. We use the 192.168.0.0/24 spectrum and the bsd box is 192.168.0.1

I'm trying to 'force' the use of our internal dns server by capturing any tcp/udp packets on port 53 destined for our ISP's dns servers and forwarding them to the local dns server also running on the same freebsd gateway.

Our internal dns server would normally forward any unknown requests to our ISP dns servers. So basically dns requests from anywhere on our local network should be 'diverted' but reuqests from the bsd server itself should be allowed through.


I'm having great difficulty trying to explain my requirements to google. I always end up with texts relating to forwarding INCOMMING packets to internal services ( such as a www server running behind nat ) which is NOT what i need

I also want to force use of our squid proxy server ( also running on the bsd box ), so that any connections to http on the internet are dealt with by the internal squid server.

Any info and in particular example configs are appreciated, im currently using both IPFilter ( for nat and firewalling ) and IPFW(2) ( for bandwidth limiting ).

In Essence:



Thanks in advance, this is freaking confusing i tell ye :P

You could probably find it on google with the keyword "transparent proxy".

But it should IMO be as simple as adding some rules to natd and ipfw similar to these:

This is just an idea, i didn't test it and I can't tell if it works...

hth,
M.

hmmm,


Those natd rules just redirect _incomming_ packets ( from the internet ) to a local dns server.

When i added a divert rule for rl0 ( which is my internal interface, i already have a rule for my external divert natd ) i loose connectivity.


I am not trying to provide dns to the world but rather force the use of our internal dns server rather than our ISP's dns server.

I would also be using any help i get here to force use of an internal squid proxy server ( all OUTGOING packets should be directed 'back in' to the squid running on 3128 or whatever )

This is getting very confusing *weep*

hi
is your BSD box the only way out to the internet for your local clients? If so than you can force your clients to use local proxy by blocking all traffic from them to any address and port other than your proxy.