add links to ip-routing transparent proxying

This commit is contained in:
Yves Rutschle committed 2024-06-12 09:40:33 +02:00
1 parent d6265e2c50
commit 5e252bb3f6
3 files changed
+31 -19

No files matched your search

+2 -2
View File
@@ -1,4 +1,4 @@
# Simple Transparent Proxy Configuration Explained #
# Transparent Proxy Configuration Using IP Routing#
This documentation is another explanation of the transparent proxy with the goal, beeing secure and minimalistic. Besides this documentation will explain, how and why this configuration works.
The explanation will only describe the connection to sshd, so the target sshd can be replace with any other target service, sslh supports.
@@ -130,4 +130,4 @@ In this case, you need to add a special route back to the sslh host, for all tra
```
The details are depending on your network settings. Als long, as the forward chain to the hidden service passes systems under your control, you can add backroutes on each system in that route. Precondition: The used ip address produces no conflict on those systems.
[I added a second document](./scenarios-for-simple-transparent-proxy.md), describing three possible scenarios in detail. Those three scenarios should cover all setups related to transparent proxying.
[I added a second document](./scenarios-for-simple-transparent-proxy.md), describing three possible scenarios in detail. Those three scenarios should cover all setups related to transparent proxying.
+6 -10
View File
@@ -1,15 +1,11 @@
# Transparent proxy
# Transparent proxy using packet marking
On Linux and FreeBSD you can use the `--transparent` option to
request transparent proxying. This means services behind `sslh`
(Apache, `sshd` and so on) will see the external IP and ports
as if the external world connected directly to them. This
simplifies IP-based access control (or makes it possible at
all).
Before reading further, make sure you try to set up
transparent proxying using [IP routing](doc/simple_transparent_proxy.md).
It is conceptually easier to understand, cleaner, and more
portable.
This document shows recipes that may help to do that.
Note that getting this to work is very tricky and
Using this method is very tricky and
detail-dependant: depending on whether the target server and
sslh are on the same machine, different machines, or
different dockers, and tool versions, all seem to change the