<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8">
<META NAME="GENERATOR" CONTENT="GtkHTML/3.16.1">
</HEAD>
<BODY>
Hello everybody,<BR>
<BR>
I am tring to make tproxy work with our squid but I have a problem with the iptable to redirect traffic to squid now.<BR>
I have compiled a linux kernel 2.6.22.18 patched with tproxy-4.0.3-2.6.22. and iptable 1.3.8. For squid, i'am using Version 2.6.STABLE5.<BR>
I think my kernel is well compiled because I see all the tproxy module loaded :<BR>
<BR>
proxy:/usr/src/linux# lsmod | grep -i proxy<BR>
xt_tproxy 1984 0 <BR>
xt_TPROXY 1984 1 <BR>
iptable_tproxy 6468 2 xt_TPROXY<BR>
ip_tables 12420 2 iptable_filter,iptable_tproxy<BR>
x_tables 14564 5 ipt_LOG,xt_tcpudp,xt_tproxy,xt_TPROXY,ip_tables<BR>
<BR>
<BR>
My iptables rules is like this :<BR>
<BR>
iptables -t tproxy -A PREROUTING -p tcp -m tcp -i gre1 --dport 80 -j LOG<BR>
iptables -t tproxy -A PREROUTING -p tcp -m tcp -i gre1 --dport 80 -j TPROXY --on-port 80<BR>
<BR>
when I check it with tcpdump, I see traffic for http port on the gre1 interface<BR>
<BR>
proxy:/usr/src/linux# tcpdump -n -i gre1<BR>
tcpdump: WARNING: arptype 778 not supported by libpcap - falling back to cooked socket<BR>
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode<BR>
listening on gre1, link-type LINUX_SLL (Linux cooked), capture size 96 bytes<BR>
13:10:51.437856 IP 62.56.240.17.3200 > 84.16.80.10.80: . ack 3247536657 win 2264 <nop,nop,timestamp 24199037 1582152><BR>
13:10:51.492666 IP 62.56.240.17.3199 > 84.16.80.10.80: . ack 3204902926 win 3604 <nop,nop,timestamp 24199051 1582156><BR>
13:10:51.523999 IP 62.56.240.17.3198 > 84.16.80.10.80: . ack 3189913679 win 16022 <nop,nop,timestamp 24199058 1582173><BR>
<BR>
when I check it on access.log of my squid, my requests are actually sent to the squid.<BR>
<BR>
But it is not the client ip which is sent to the Internet but the squid box IP.<BR>
<BR>
when I issue iptables-save -c command to check if there are traffic that enter my iptables rule, the counter so zero traffic.<BR>
<BR>
proxy:/usr/src/linux# iptables-save -t tproxy -c<BR>
# Generated by iptables-save v1.3.8 on Wed Feb 20 13:07:45 2008<BR>
*tproxy<BR>
:PREROUTING ACCEPT [128:11992]<BR>
[0:0] -A PREROUTING -i gre1 -p tcp -m tcp --dport 80 -j LOG <BR>
[0:0] -A PREROUTING -i gre1 -p tcp -m tcp --dport 80 -j TPROXY --on-port 80 --on-ip 0.0.0.0 <BR>
COMMIT<BR>
<BR>
even the LOG don't tell me anything about traffic in gre1 interfaces.<BR>
<BR>
what I see in the log is this error that appear from time to time:<BR>
<BR>
Feb 20 13:08:31 proxy squid[2353]: parseHttpRequest: NF getsockopt(SO_ORIGINAL_DST) failed: (92) Protocol not available <BR>
Feb 20 13:08:31 proxy squid[2353]: tproxy ip=62.56.240.17,0x11f0383e,port=0 ERROR ASSIGN <BR>
<BR>
Can anyone tell me why my iptables don't redirect the traffic to the squid?<BR>
<BR>
Best Regards<BR>
<BR>
<BR>
<TABLE CELLSPACING="0" CELLPADDING="0" WIDTH="100%">
<TR>
<TD>
Nantenaina Tianarivo<BR>
Sys Admin Blueline<BR>
-------------------<BR>
Today is what happened to yesterday.<BR>
<BR>
<BR>
</TD>
</TR>
</TABLE>
</BODY>
</HTML>