From: W. Trevor King <wking@tremily.us>
Date: Fri, 21 Feb 2014 19:08:59 +0000 (-0800)
Subject: README: Document tranparent proxy setup
X-Git-Tag: v0.2~2
X-Git-Url: http://git.tremily.us/?a=commitdiff_plain;h=1018fbca115403bbd7cf5960036b7976c0c0e76f;p=package-cache.git

README: Document tranparent proxy setup
---

diff --git a/README b/README
index 1a8f3fa..6a0d1c3 100644
--- a/README
+++ b/README
@@ -59,6 +59,31 @@ Portage_, that's going to be something like:
 
 in your ``/etc/portage/make.conf``.
 
+If you *don't* want to tweak your clients (perhaps there are many of
+them, or they are out of your direct control), you can add some
+firewall rules to your router to transparently proxy specific Gentoo
+mirrors.  With an internal ``eth1`` and an internal proxy on
+192.168.0.11, that looks something like::
+
+  # CACHE_IP=192.168.0.11
+  # for SOURCE_IP in $(dig +short distfiles.gentoo.org);
+  > do
+  >   iptables --table nat --append PREROUTING --protocol tcp \
+  >     --in-interface eth1 ! --source "${CACHE_IP}" \
+  >     --destination "${SOURCE_IP}" \
+  >     --match tcp --destination-port 80 \
+  >     --jump DNAT --to-destination "${CACHE_IP}:4000" ;
+  > done
+
+To remove those entries later, repeat the command with ``--delete``
+instead of ``--append``.  You may need to list the ``SOURCE_IP`` values
+explicitly if the DNS entries have changed.  Run::
+
+  # iptables --table nat --list PREROUTING --numeric
+
+to list the entries.  See ``iptables(8)`` and
+``iptables-extensions(8)`` for more details.
+
 .. _Gentoo's distfiles:
   https://wiki.gentoo.org/wiki/Project:Infrastructure/Source_mirrors
 .. _Cache-Control headers: