<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
Hello,
<div class=""><br class="">
</div>
<div class="">OK, I added the ssl_bump slice on the skype domains text file</div>
<div class="">I installed ipset and ran the script.</div>
<div class=""><br class="">
</div>
<div class="">Now access.log has much less skype related logs:</div>
<div class=""><br class="">
</div>
<div class="">What is left is:</div>
<div class="">
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">1481044996.398 3412
</span><span style="font-variant-ligatures: no-common-ligatures; color: #c33720" class="">10.0.0.11</span><span style="font-variant-ligatures: no-common-ligatures" class=""> TAG_NONE/200 0 CONNECT 132.245.1.32:443 - ORIGINAL_DST/132.245.1.32 -</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">1481044996.423 0
</span><span style="font-variant-ligatures: no-common-ligatures; color: #c33720" class="">10.0.0.11</span><span style="font-variant-ligatures: no-common-ligatures" class=""> TAG_NONE/400 3998 REGISTER
<a href="sip:solcv.comSIP/2.0" class="">sip:solcv.comSIP/2.0</a> - HIER_NONE/- text/html</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">1481045000.296 372
</span><span style="font-variant-ligatures: no-common-ligatures; color: #c33720" class="">10.0.0.11</span><span style="font-variant-ligatures: no-common-ligatures" class=""> TAG_NONE/200 0 CONNECT 134.170.113.207:443 - ORIGINAL_DST/134.170.113.207 -</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">1481045000.325 0
</span><span style="font-variant-ligatures: no-common-ligatures; color: #c33720" class="">10.0.0.11</span><span style="font-variant-ligatures: no-common-ligatures" class=""> TAG_NONE/400 3998 REGISTER
<a href="sip:solcv.comSIP/2.0" class="">sip:solcv.comSIP/2.0</a> - HIER_NONE/- text/html</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">1481045008.685 4259
</span><span style="font-variant-ligatures: no-common-ligatures; color: #c33720" class="">10.0.0.11</span><span style="font-variant-ligatures: no-common-ligatures" class=""> TAG_NONE/200 0 CONNECT 134.170.113.207:443 - ORIGINAL_DST/134.170.113.207 -</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">1481045008.726 0
</span><span style="font-variant-ligatures: no-common-ligatures; color: #c33720" class="">10.0.0.11</span><span style="font-variant-ligatures: no-common-ligatures" class=""> TAG_NONE/400 3998 REGISTER
<a href="sip:solcv.comSIP/2.0" class="">sip:solcv.comSIP/2.0</a> - HIER_NONE/- text/html</span></div>
</div>
<div class="">
<div class=""><br class="webkit-block-placeholder">
</div>
<div class=""><br class="webkit-block-placeholder">
</div>
<div class="">although <a href="http://solve.com" class="">solve.com</a> is in the text file.</div>
<div class=""><br class="">
</div>
<div class="">I ran whois on the first IP and got:</div>
<div class=""><br class="">
</div>
<div class="">
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">NetRange: 132.245.0.0 - 132.245.255.255</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">CIDR: 132.245.0.0/16</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">NetName: MICROSOFT</span></div>
</div>
<div class=""><br class="">
</div>
<div class=""><br class="webkit-block-placeholder">
</div>
<div class="">Same with the 134.170. address. Can we slice that range?</div>
<div class=""><br class="webkit-block-placeholder">
</div>
<div class=""><br class="webkit-block-placeholder">
</div>
<div class=""><br class="webkit-block-placeholder">
</div>
<div class=""><span><img height="58" width="58" apple-inline="yes" id="CA3E2AF1-D01F-416A-9F7B-322A4FC07B76" apple-width="yes" apple-height="yes" src="cid:DA9A1E3F-3876-4EF2-BBA2-D3942A06ACE1@routerb408e2.com" class=""></span>
<div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">
<b class=""><br class="Apple-interchange-newline">
Sameh Onaissi</b></div>
<div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">
<b class="">Ingeniero de Soporte</b></div>
<div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">
<b class="">Sol Cable Visión</b></div>
<div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">
<b class="">Cel:</b><span class="Apple-converted-space"> </span>316-3023424</div>
<div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">
<b class="">Email:</b><span class="Apple-converted-space"> </span><a href="mailto:sameh.onaissi@solcv.com" class="">sameh.onaissi@solcv.com</a></div>
<br class="Apple-interchange-newline" style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
<br class="Apple-interchange-newline" style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
<br class="Apple-interchange-newline" style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
<span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><span><img height="38" width="45" apple-inline="yes" id="0CFCBEE5-A30A-41FC-AB93-36D8569BBBEA" apple-width="yes" apple-height="yes" src="cid:2FD1C3AB-E45C-49F0-84AB-0F8AC658BD11@routerb408e2.com" class=""></span><em style="font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; color: rgb(0, 128, 0); font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 16px; background-color: rgb(255, 255, 255);" class=""><strong class="">Piensa
en el medio ambiente antes de imprimir este email.</strong></em> </span></div>
<br class="">
<div>
<blockquote type="cite" class="">
<div class="">On Dec 6, 2016, at 12:11 PM, Eliezer Croitoru <<a href="mailto:eliezer@ngtech.co.il" class="">eliezer@ngtech.co.il</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class=""><font face="Calibri" size="2" style="font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span style="font-size: 11pt;" class="">
<div class="">Hey,</div>
<div class=""><font face="Times New Roman" size="3" class=""><span style="font-size: 12pt;" class=""> </span></font></div>
<div class="">Depends on your OS you will need to installthe ipset package.</div>
<div class="">Try to run “apt-get install ipset”.</div>
<div class="">And then run the script.</div>
<div class=""> </div>
<div class="">Eliezer</div>
<div class=""><font face="Times New Roman" size="3" class=""><span style="font-size: 12pt;" class=""> </span></font></div>
<div class=""><font face="Times New Roman" class="">----</font></div>
<div class=""><font face="Times New Roman" size="3" class=""><span style="font-size: 12pt;" class=""><a href="http://ngtech.co.il/lmgtfy/" class=""><font face="Arial Rounded MT Bold" size="2" color="#0563C1" class=""><span style="font-size: 11pt;" class=""><u class="">Eliezer
Croitoru</u></span></font></a><br class="">
<font face="Arial Rounded MT Bold" size="2" class=""><span style="font-size: 11pt;" class="">Linux System Administrator<br class="">
Mobile: +972-5-28704261<br class="">
Email:<span class="Apple-converted-space"> </span><a href="mailto:eliezer@ngtech.co.il" class="">eliezer@ngtech.co.il</a></span></font></span></font></div>
<div class=""><font face="Times New Roman" size="3" class=""><span style="font-size: 12pt;" class=""><span id="cid:7BFC0572B617BFCAB4793447DBBF28C4D7A7D0E2@namprd05.prod.outlook.com"><Untitled Attachment 1.jpg></span><font size="2" class=""><span style="font-size: 11pt;" class=""></span></font></span></font></div>
<div class=""><font face="Times New Roman" size="3" class=""><span style="font-size: 12pt;" class=""> </span></font></div>
<div class=""><b class="">From:</b><span class="Apple-converted-space"> </span>Sameh Onaissi [<a href="mailto:sameh.onaissi@solcv.com" class="">mailto:sameh.onaissi@solcv.com</a>]<span class="Apple-converted-space"> </span><br class="">
<b class="">Sent:</b><span class="Apple-converted-space"> </span>Tuesday, December 6, 2016 5:23 PM<br class="">
<b class="">To:</b><span class="Apple-converted-space"> </span>Amos Jeffries <<a href="mailto:squid3@treenet.co.nz" class="">squid3@treenet.co.nz</a>><br class="">
<b class="">Cc:</b><span class="Apple-converted-space"> </span>Eliezer Croitoru <<a href="mailto:eliezer@ngtech.co.il" class="">eliezer@ngtech.co.il</a>><br class="">
<b class="">Subject:</b><span class="Apple-converted-space"> </span>Re: [squid-users] Skype for Business behind a transparent squid (TProxy) HTTP/S</div>
<div class=""><font face="Times New Roman" size="3" class=""><span style="font-size: 12pt;" class=""> </span></font></div>
<div class=""><font face="Times New Roman" size="3" class=""><span style="font-size: 12pt;" class="">Amos, thanks for the reply.<span class="Apple-converted-space"> </span></span></font></div>
<div class=""><font face="Times New Roman" size="3" class=""><span style="font-size: 12pt;" class=""> </span></font></div>
<div class=""><font face="Times New Roman" size="3" class=""><span style="font-size: 12pt;" class=""> </span></font></div>
<div class=""><font face="Times New Roman" size="3" class=""><span style="font-size: 12pt;" class="">This is getting more confusing.</span></font></div>
<div class=""><font face="Times New Roman" size="3" class=""><span style="font-size: 12pt;" class=""> </span></font></div>
<div class=""><font face="Times New Roman" size="3" class=""><span style="font-size: 12pt;" class="">I changed the script to: <a href="http://pastebin.com/jLgywstg" class=""><font color="blue" class=""><u class="">http://pastebin.com/jLgywstg</u></font></a></span></font></div>
<div class=""><font face="Times New Roman" size="3" class=""><span style="font-size: 12pt;" class=""> </span></font></div>
<div class=""><font face="Times New Roman" size="3" class=""><span style="font-size: 12pt;" class="">And I ran it, but I am getting errors:</span></font></div>
<div class=""><font face="Times New Roman" size="3" class=""><span style="font-size: 12pt;" class=""> </span></font></div>
<div class=""><font face="Helvetica" size="2" color="#232A2A" class=""><span style="font-size: 10.5pt;" class=""><span style="background-color: rgb(236, 240, 240);" class="">sudo sh</span><span style="background-color: rgb(236, 240, 240);" class=""><span class="Apple-converted-space"> </span></span><a href="http://bypass.sh/" class=""><span style="background-color: rgb(236, 240, 240);" class=""><u class="">bypass.sh</u></span></a><span style="background-color: rgb(236, 240, 240);" class=""><span class="Apple-converted-space"> </span>+
iptables -t mangle -L PREROUTING + grep bypasspool + [ 1 -ne 0 ] + iptables -t mangle -I PREROUTING -m set --match-set bypasspool dst,src -j DIVERT iptables</span><span style="background-color: rgb(236, 240, 240);" class=""><span class="Apple-converted-space"> </span></span><a href="http://v1.6.0/" class=""><span style="background-color: rgb(236, 240, 240);" class=""><u class="">v1.6.0:</u></span></a><span style="background-color: rgb(236, 240, 240);" class=""><span class="Apple-converted-space"> </span>Set
bypasspool doesn't exist. Try `iptables -h' or 'iptables --help' for more information. + ipset create bypasspool hash:ip</span><span style="background-color: rgb(236, 240, 240);" class=""><span class="Apple-converted-space"> </span></span><a href="http://bypass.sh/" class=""><span style="background-color: rgb(236, 240, 240);" class=""><u class="">bypass.sh:</u></span></a><span style="background-color: rgb(236, 240, 240);" class=""><span class="Apple-converted-space"> </span>10:</span><span style="background-color: rgb(236, 240, 240);" class=""><span class="Apple-converted-space"> </span></span><a href="http://bypass.sh/" class=""><span style="background-color: rgb(236, 240, 240);" class=""><u class="">bypass.sh:</u></span></a><span style="background-color: rgb(236, 240, 240);" class=""><span class="Apple-converted-space"> </span>ipset:
not found + read item + echo</span><span style="background-color: rgb(236, 240, 240);" class=""></span><a href="http://lyncdiscover.solcv.com/" class=""><span style="background-color: rgb(236, 240, 240);" class=""><u class="">lyncdiscover.solcv.com</u></span></a><span style="background-color: rgb(236, 240, 240);" class=""><span class="Apple-converted-space"> </span></span><a href="http://lyncdiscover.solcv.com/" class=""><span style="background-color: rgb(236, 240, 240);" class=""><u class="">lyncdiscover.solcv.com</u></span></a><span style="background-color: rgb(236, 240, 240);" class=""><span class="Apple-converted-space"> </span>+
host -4</span><span style="background-color: rgb(236, 240, 240);" class=""><span class="Apple-converted-space"> </span></span><a href="http://lyncdiscover.solcv.com/" class=""><span style="background-color: rgb(236, 240, 240);" class=""><u class="">lyncdiscover.solcv.com</u></span></a><span style="background-color: rgb(236, 240, 240);" class=""><span class="Apple-converted-space"> </span>+
grep has address + awk {print $4} + xargs -l1 ipset add bypasspool xargs: ipset: No such file or directory + read item + echo</span><span style="background-color: rgb(236, 240, 240);" class=""><span class="Apple-converted-space"> </span></span><a href="http://webdir0a.online.lync.com/" class=""><span style="background-color: rgb(236, 240, 240);" class=""><u class="">webdir0a.online.lync.com</u></span></a><span style="background-color: rgb(236, 240, 240);" class=""></span><a href="http://webdir0a.online.lync.com/" class=""><span style="background-color: rgb(236, 240, 240);" class=""><u class="">webdir0a.online.lync.com</u></span></a><span style="background-color: rgb(236, 240, 240);" class=""><span class="Apple-converted-space"> </span>+
host -4</span><span style="background-color: rgb(236, 240, 240);" class=""><span class="Apple-converted-space"> </span></span><a href="http://webdir0a.online.lync.com/" class=""><span style="background-color: rgb(236, 240, 240);" class=""><u class="">webdir0a.online.lync.com</u></span></a><span style="background-color: rgb(236, 240, 240);" class=""><span class="Apple-converted-space"> </span>+
grep has address + awk {print $4} + xargs -l1 ipset add bypasspool xargs: ipset: No such file or director</span><span style="background-color: rgb(236, 240, 240);" class="">y</span></span></font></div>
<div class=""><font face="Times New Roman" size="3" class=""><span style="font-size: 12pt;" class=""> </span></font></div>
<div class=""><font face="Times New Roman" size="3" class=""><span style="font-size: 12pt;" class="">… this goes on the same for all the domains in the text file</span></font></div>
<div class=""><font face="Times New Roman" size="3" class=""><span style="font-size: 12pt;" class=""> </span></font></div>
<div class=""><font face="Times New Roman" size="3" class=""><span style="font-size: 12pt;" class="">My iptables is still <<a href="http://pastebin.com/SqpbmYQQ" class=""><font color="blue" class=""><u class="">http://pastebin.com/SqpbmYQQ</u></font></a>></span></font></div>
<div class=""><font face="Times New Roman" size="3" class=""><span style="font-size: 12pt;" class=""> </span></font></div>
<div class=""><font face="Times New Roman" size="3" class=""><span style="font-size: 12pt;" class="">I did not quite understand what you meant by <br class="">
</span></font></div>
<div class=""><font face="Times New Roman" size="3" class=""><span style="font-size: 12pt;" class="">You should test whether -m set or -m socket work faster and put that one<br class="">
first. My change above places it at line 2 (after -m socket) assuming<br class="">
your iptables script is still <<a href="http://pastebin.com/SqpbmYQQ" class=""><font color="blue" class=""><u class="">http://pastebin.com/SqpbmYQQ</u></font></a>></span></font></div>
<div class=""><font face="Times New Roman" size="3" class=""><span style="font-size: 12pt;" class=""> </span></font></div>
<div class=""><font face="Times New Roman" size="3" class=""><span style="font-size: 12pt;" class="">should I incorporate the bypass script into my iptables.sh script? run iptables first then bypass?</span></font></div>
<div class=""><font face="Times New Roman" size="3" class=""><span style="font-size: 12pt;" class=""> </span></font></div>
<div class=""><font face="Times New Roman" size="3" class=""><span style="font-size: 12pt;" class=""> </span></font></div>
<div class=""><font face="Times New Roman" size="3" class=""><span style="font-size: 12pt;" class=""> </span></font></div>
<div class=""><font face="Times New Roman" size="3" class=""><span style="font-size: 12pt;" class="">On a side note, would adding ssl_bump exceptions to squid.conf do it?</span></font></div>
<div class=""><font face="Times New Roman" size="3" class=""><span style="font-size: 12pt;" class="">Something like: </span></font></div>
<div class=""><font face="Times New Roman" size="3" class=""><span style="font-size: 12pt;" class=""> </span></font></div>
<div class=""><font face="Times New Roman" size="3" class=""><span style="font-size: 12pt;" class="">acl skype_domains <path to file></span></font></div>
<div class=""><font face="Times New Roman" size="3" class=""><span style="font-size: 12pt;" class="">ssl_bump splice skype_domains</span></font></div>
<div class=""><font face="Times New Roman" size="3" class=""><span style="font-size: 12pt;" class="">ssl_bump bump all</span></font></div>
<div class=""><font face="Times New Roman" size="3" class=""><span style="font-size: 12pt;" class=""> </span></font></div>
<div class=""><font face="Times New Roman" size="3" class=""><span style="font-size: 12pt;" class=""> </span></font></div>
<div class=""><font face="Times New Roman" size="3" class=""><span style="font-size: 12pt;" class=""> </span></font></div>
<div class=""><font face="Times New Roman" size="3" class=""><span style="font-size: 12pt;" class="">Again, thanks again for your help.</span></font></div>
<div class=""><font face="Times New Roman" size="3" class=""><span style="font-size: 12pt;" class=""> </span></font></div>
<div class=""><font face="Times New Roman" size="3" class=""><span style="font-size: 12pt;" class=""> </span></font></div>
<div class=""><font face="Times New Roman" size="3" class=""><span style="font-size: 12pt;" class=""><br class="">
<span id="cid:82AA6A073F40694EF2E7B1B0141089A6A779AEE8@namprd05.prod.outlook.com"><Untitled Attachment 2.jpg></span><font face="Helvetica" size="2" class=""><span style="font-size: 9pt;" class=""><span class="Apple-converted-space"> </span></span></font><font face="Calibri" color="green" class=""><b class=""><i class="">Piensa
en el medio ambiente antes de impr</i></b></font><font face="Calibri" color="green" class=""><b class=""><i class="">imir este email.</i></b></font><font face="Helvetica" size="2" class=""><span style="font-size: 9pt;" class=""></span></font></span></font></div>
<div class=""><font face="Times New Roman" size="3" class=""><span style="font-size: 12pt;" class=""> </span></font></div>
<div class=""><font face="Times New Roman" size="3" class=""><span style="font-size: 12pt;" class="">On Dec 6, 2016, at 9:50 AM, Amos Jeffries <<a href="mailto:squid3@treenet.co.nz" class=""><font color="blue" class=""><u class="">squid3@treenet.co.nz</u></font></a>>
wrote:</span></font></div>
<div class=""><font face="Times New Roman" size="3" class=""><span style="font-size: 12pt;" class=""> </span></font></div>
<div class=""><font face="Times New Roman" size="3" class=""><span style="font-size: 12pt;" class="">On 7/12/2016 3:19 a.m., Sameh Onaissi wrote:<br class="">
</span></font></div>
<div style="margin-bottom: 12pt;" class=""><font face="Times New Roman" size="3" class=""><span style="font-size: 12pt;" class="">Hello,<br class="">
<br class="">
I tried doing the changes to nat/REDIRECT in iptables.sh and I must have messed up somewhere, so I am sticking with mangle/tproxy for now since squid is working with them.<br class="">
<br class="">
How can I change Eliezer’s script to mangle/tproxy?<span class="Apple-converted-space"> </span><a href="https://gist.github.com/elico/e0faadf0cc63942c5aaade808a87deef" class=""><font color="blue" class=""><u class="">https://gist.github.com/elico/e0faadf0cc63942c5aaade808a87deef</u></font></a><br class="">
<br class="">
Excuse my novice knowledge in iptables.</span></font></div>
<div class=""><font face="Times New Roman" size="3" class=""><span style="font-size: 12pt;" class=""><br class="">
No worries.<br class="">
<br class="">
You need to change where iptables attaches the 'bypasspool'. Both the<br class="">
table/location (-t) and the jump/action (-j).<br class="">
<br class="">
iptables -t mangle -L PREROUTING |grep bypasspool<br class="">
if [ "$?" -ne "0" ];then<br class="">
<br class="">
iptables -t mangle -I 2 PREROUTING \<br class="">
-m set --match-set bypasspool dst,src \<br class="">
-j DIVERT<br class="">
<br class="">
fi<br class="">
<br class="">
You should test whether -m set or -m socket work faster and put that one<br class="">
first. My change above places it at line 2 (after -m socket) assuming<br class="">
your iptables script is still <<a href="http://pastebin.com/SqpbmYQQ" class=""><font color="blue" class=""><u class="">http://pastebin.com/SqpbmYQQ</u></font></a>><br class="">
<br class="">
(Your script should do that line adding, not Eliezers - so that you can<br class="">
be sure the order is always correct).<br class="">
<br class="">
<br class="">
BTW: you should use iptables-save / iptables-restore instead of a slow<br class="">
script calling iptables "manually". Those other tools will ensure there<br class="">
are no gaps in the firewall initialization for nasty traffic to sneak<br class="">
through.<br class="">
<br class="">
</span></font></div>
<div class=""><font face="Times New Roman" size="3" class=""><span style="font-size: 12pt;" class=""><br class="">
I am looking at access.log to collect all domains I see heading to skype for business, as well as IPs. My question is, can I add the domains AND IPs into the domains-to-bypass.txt that the above script uses?</span></font></div>
<div style="margin-bottom: 12pt;" class=""><font face="Times New Roman" size="3" class=""><span style="font-size: 12pt;" class=""><br class="">
IIRC you should be able to use domain as the parameter to ipset. But it<br class="">
will resolve the domain immediately and only add those IPs that it finds<br class="">
at that time into the pool. Any future changes, or a hidden set of IPs<br class="">
that rotate in/out will not be listed.<br class="">
<br class="">
Amos</span></font></div>
<div class=""><font face="Times New Roman" size="3" class=""><span style="font-size: 12pt;" class=""> </span></font></div>
<div class=""><font face="Times New Roman" size="3" class=""><span style="font-size: 12pt;" class=""> </span></font></div>
</span></font><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class=""></span></div>
</blockquote>
</div>
<br class="">
</div>
</body>
</html>