Re: [squid-users] Re: source address ip spoofing

Hey Julian,

I think you do not understand couple things.
When you use a proxy in a Forward mode which is configured in the
clients browser using wpad.dat, there is no means to SPOOF their IP.
There is indeed a way to do it but it also depends on many factors which
in your case I suspect you cannot meet.

The IP address which sites shows is only depends on their own scripts
and way to look at the requests.
The basic way is to show only the src IP of the machine such as the proxy.
There is a way to detect a x_forward_for header and to show this but
nobody in the real world will use this header as a src IP in his tests
if he is sane.

For example if this LAN network(if I understood right) has a segment of
192.168.0.0/24 and the internet server will show the real client ip as
"192.168.0.100"(example) it is a lie from his point of view and from the
internet point of view.
Also in this case there is no way to spoof this address since it's a
local network address space which do not exists on the internet.

Hope it explained the basic issue.
Eliezer

On 08/28/2014 08:51 PM, Julian wrote:
> Hi Amos,
>
> We turned off X-Forwarded-For/Via headers and the effect was quite opposite
> we expected:(
> Now if a host checks "What is my IP?" against any online website it shows
> only the IP address of the Proxy Server.
>
> What we want is exactly the opposite.
> When a host checks their IP we want them to see their own IP with no show of
> the Proxy Server IP.
> This way we don't have to log the hosts access because they will identify to
> any Internet Server with their own IP. We don't want our users to hide
> behind Proxy IP.
>
> Would this be possible when using wpad redirection?
> Is there a way to make Squid completely spoof source IP and become
> transparent for the users?
>
> Thank you for your help,
> Julian
>
Received on Thu Aug 28 2014 - 22:50:42 MDT