[tproxy] Install tproxy

[Joaquim Petiz]

Hi list,

I have problems for install squid+tproxy on CentOS 5.2.
I using README.txt from balabit.com but not working, connections not register in access.log but in tcpdump on gateway register traffic.
My topology: 

Link <> GW <> Tproxy <> Server

Connections from Server register in tcpdump in the GW, access.log in the Tproxy not...

CentOS 5.2
Iptables 1.4.0
squid-3.HEAD-20080831
tproxy-iptables-1.4.0-20080521-113954-1211362794.patch
tproxy-kernel-2.6.25-20080519-165031-1211208631
Kernel 2.6.25.11

iptables -t mangle -nL
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         
DIVERT     tcp  --  0.0.0.0/0            0.0.0.0/0           socket 
TPROXY     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:80 TPROXY redirect 0.0.0.0:50080 mark 0x1/0x1

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         

Chain DIVERT (1 references)
target     prot opt source               destination         
MARK       all  --  0.0.0.0/0            0.0.0.0/0           MARK set 0x1 
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           


ip rule sh
0:      from all lookup 255 
32765:  from all fwmark 0x1 lookup 100 
32766:  from all lookup main 
32767:  from all lookup default 

ip route sh table 100
local default dev lo  scope host 

squid.conf
http_port 50080 transparent tproxy
cache_dir ufs /cache 100 16 256
access_log /var/logs/access.log squid
visible_hostname tproxy
acl manager proto cache_object
acl localhost src 127.0.0.1/32
acl to_localhost dst 127.0.0.0/8
acl localnet src 10.0.0.0/8     # RFC1918 possible internal network
acl localnet src 172.16.0.0/12  # RFC1918 possible internal network
acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
acl ALL2 src 192.168.0.0/16
acl SSL_ports port 443
acl Safe_ports port 80          # http
acl Safe_ports port 21          # ftp
acl Safe_ports port 443         # https
acl Safe_ports port 70          # gopher
acl Safe_ports port 210         # wais
acl Safe_ports port 1025-65535  # unregistered ports
acl Safe_ports port 280         # http-mgmt
acl Safe_ports port 488         # gss-http
acl Safe_ports port 591         # filemaker
acl Safe_ports port 777         # multiling http
acl CONNECT method CONNECT
http_access allow all
http_access allow ALL2
http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localnet
http_access deny all
icp_access allow localnet
icp_access deny all
htcp_access allow localnet
htcp_access deny all
hierarchy_stoplist cgi-bin ?
refresh_pattern ^ftp:           1440    20%     10080
refresh_pattern ^gopher:        1440    0%      1440
refresh_pattern -i (/cgi-bin/|\?) 0     0%      0
refresh_pattern .               0       20%     4320
icp_port 3130
error_directory /usr/share/errors/en
coredump_dir /var/cache







      Novos endereços, o Yahoo! que você conhece. Crie um email novo com a sua cara @ymail.com ou @rocketmail.com.
http://br.new.mail.yahoo.com/addresses
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/tproxy/attachments/20080901/19d21f00/attachment.htm