<html><head></head><body>Check that the userspace application enables IP_TRANSPARENT on the listening socket. You can do that via strace.<br>
<br>
Tproxy will only match listener sockets with that flag set.<br>
-- <br>
Bazsi<br><br><div class="gmail_quote">On May 20, 2014 6:11:00 PM CEST, Tiago <sytker@gmail.com> wrote:<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<div dir="ltr"><p style="font-family:arial,sans-serif;font-size:13px">Hello,</p><p style="font-family:arial,sans-serif;font-size:13px">Usage: Apache Trafficserver (web cache) fully transparent using tproxy</p><p style="font-family:arial,sans-serif;font-size:13px">
OS: Ubuntu 12.04<br /></p><p style="font-family:arial,sans-serif;font-size:13px"><br /></p><p style="font-family:arial,sans-serif;font-size:13px">I’m trying to setup this:<br /></p><p style="font-family:arial,sans-serif;font-size:13px">
My Router / firewall which has:<br /></p><p style="font-family:arial,sans-serif;font-size:13px">- port 23 (customer network, which has gateway x.x.x.x) </p><p style="font-family:arial,sans-serif;font-size:13px">- port2 (traffic server cache, which has IP y.y.y.y and bound to 8080 port).</p>
<p style="font-family:arial,sans-serif;font-size:13px">PS: The web cache has only one ethernet interface (eth2).</p><p style="font-family:arial,sans-serif;font-size:13px">- ISPs (internet links) connected to the router.</p>
<p style="font-family:arial,sans-serif;font-size:13px"><br /></p><p style="font-family:arial,sans-serif;font-size:13px">My router has:</p><p style="font-family:arial,sans-serif;font-size:13px">1) Policy routes in place redirecting all requests from customer network with destination port 80 via port2 to apache traffic server.</p>
<p style="font-family:arial,sans-serif;font-size:13px">2) Policy routes in place redirecting all answers from ISPs (from source port 80) via port2 to apache traffic server.</p><p style="font-family:arial,sans-serif;font-size:13px">
When a customer access any website, those packets are being sent to the web cache. But nothing else happens (except timeout).</p><p style="font-family:arial,sans-serif;font-size:13px">My modules:</p><p style="font-family:arial,sans-serif;font-size:13px">
lsmod</p><p style="font-family:arial,sans-serif;font-size:13px">Module Size Used by<br /></p><p style="font-family:arial,sans-serif;font-size:13px">nf_nat 25891 2 ipt_REDIRECT,iptable_nat</p>
<p style="font-family:arial,sans-serif;font-size:13px">nf_conntrack_ipv4 19716 3 iptable_nat,nf_nat</p><p style="font-family:arial,sans-serif;font-size:13px">nf_conntrack 81926 3 iptable_nat,nf_nat,nf_conntrack_ipv4</p>
<p style="font-family:arial,sans-serif;font-size:13px">iptable_filter 12810 0 </p><p style="font-family:arial,sans-serif;font-size:13px">xt_tcpudp 12603 1 </p><p style="font-family:arial,sans-serif;font-size:13px">
xt_TPROXY 12853 0 </p><p style="font-family:arial,sans-serif;font-size:13px">nf_tproxy_core 12610 1 xt_TPROXY,[permanent]</p><p style="font-family:arial,sans-serif;font-size:13px">xt_socket 12715 0 </p>
<p style="font-family:arial,sans-serif;font-size:13px">nf_defrag_ipv4 12729 3 nf_conntrack_ipv4,xt_TPROXY,xt_socket</p><p style="font-family:arial,sans-serif;font-size:13px">ip6_tables 27864 2 xt_TPROXY,xt_socket</p>
<p style="font-family:arial,sans-serif;font-size:13px">nf_defrag_ipv6 13368 2 xt_TPROXY,xt_socket</p><p style="font-family:arial,sans-serif;font-size:13px">xt_mark 12563 2 </p><p style="font-family:arial,sans-serif;font-size:13px">
iptable_mangle 12734 1 </p><p style="font-family:arial,sans-serif;font-size:13px">ip_tables 27473 3 iptable_nat,iptable_filter,iptable_mangle</p><p style="font-family:arial,sans-serif;font-size:13px">
x_tables 29846 10 ipt_REDIRECT,iptable_nat,iptable_filter,xt_tcpudp,xt_TPROXY,xt_socket,ip6_tables,xt_mark,iptable_mangle,ip_tables</p><p style="font-family:arial,sans-serif;font-size:13px">btrfs 652957 0 </p>
<p style="font-family:arial,sans-serif;font-size:13px"><br /></p><p style="font-family:arial,sans-serif;font-size:13px">Linux options:<br /></p><p style="font-family:arial,sans-serif;font-size:13px">echo 1 > /proc/sys/net/ipv4/ip_forward</p>
<p style="font-family:arial,sans-serif;font-size:13px">echo 0 > /proc/sys/net/ipv4/conf/default/rp_filter</p><p style="font-family:arial,sans-serif;font-size:13px">echo 0 > /proc/sys/net/ipv4/conf/all/rp_filter</p><p style="font-family:arial,sans-serif;font-size:13px">
echo 0 > /proc/sys/net/ipv4/conf/eth2/rp_filter</p><p style="font-family:arial,sans-serif;font-size:13px">echo 1 > /proc/sys/net/ipv4/conf/eth2/proxy_arp</p><p style="font-family:arial,sans-serif;font-size:13px"><br />
</p><p style="font-family:arial,sans-serif;font-size:13px">Iptables Rules:</p><p style="font-family:arial,sans-serif;font-size:13px">iptables -t mangle -N DIVERT</p><p style="font-family:arial,sans-serif;font-size:13px">iptables -t mangle -A DIVERT -j MARK --set-mark 1</p>
<p style="font-family:arial,sans-serif;font-size:13px">iptables -t mangle -A DIVERT -j ACCEPT</p><p style="font-family:arial,sans-serif;font-size:13px">iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT</p><p style="font-family:arial,sans-serif;font-size:13px">
iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 8080</p><p style="font-family:arial,sans-serif;font-size:13px">ip rule add fwmark 1 lookup 100</p><p style="font-family:arial,sans-serif;font-size:13px">
ip route add local <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> dev lo table 100</p><p style="font-family:arial,sans-serif;font-size:13px"><br /></p><p style="font-family:arial,sans-serif;font-size:13px">Apache traffic server debug when trying to access <a href="http://www.inter.com.ve/" target="_blank">www.inter.com.ve</a>:</p>
<p style="font-family:arial,sans-serif;font-size:13px">tcpdump -ni eth2 host 200.8.57.5<br /></p><p style="font-family:arial,sans-serif;font-size:13px">tcpdump: verbose output suppressed, use -v or -vv for full protocol decode</p>
<p style="font-family:arial,sans-serif;font-size:13px">listening on eth2, link-type EN10MB (Ethernet), capture size 65535 bytes</p><p style="font-family:arial,sans-serif;font-size:13px">03:48:27.880413 IP x.x.x.5.53663 > 200.8.57.5.80: Flags [S], seq 2084747082, win 65535, options [mss 1440,nop,wscale 4,nop,nop,TS val 903707860 ecr 0,sackOK,eol], length 0</p>
<p style="font-family:arial,sans-serif;font-size:13px">03:48:28.882079 IP x.x.x.5.53663 > 200.8.57.5.80: Flags [S], seq 2084747082, win 65535, options [mss 1440,nop,wscale 4,nop,nop,TS val 903708860 ecr 0,sackOK,eol], length 0</p>
<p style="font-family:arial,sans-serif;font-size:13px">03:48:29.885816 IP x.x.x.5.53663 > 200.8.57.5.80: Flags [S], seq 2084747082, win 65535, options [mss 1440,nop,wscale 4,nop,nop,TS val 903709861 ecr 0,sackOK,eol], length 0</p>
<p style="font-family:arial,sans-serif;font-size:13px">03:48:30.991950 IP x.x.x.5.53663 > 200.8.57.5.80: Flags [S], seq 2084747082, win 65535, options [mss 1440,nop,wscale 4,nop,nop,TS val 903710959 ecr 0,sackOK,eol], length 0</p>
<p style="font-family:arial,sans-serif;font-size:13px">03:48:32.000267 IP x.x.x.5.53663 > 200.8.57.5.80: Flags [S], seq 2084747082, win 65535, options [mss 1440,nop,wscale 4,nop,nop,TS val 903711960 ecr 0,sackOK,eol], length 0</p>
<p style="font-family:arial,sans-serif;font-size:13px">03:48:33.105923 IP x.x.x.5.53663 > 200.8.57.5.80: Flags [S], seq 2084747082, win 65535, options [mss 1440,nop,wscale 4,nop,nop,TS val 903713058 ecr 0,sackOK,eol], length 0</p>
<p style="font-family:arial,sans-serif;font-size:13px">03:48:35.117941 IP x.x.x.5.53663 > 200.8.57.5.80: Flags [S], seq 2084747082, win 65535, options [mss 1440,nop,wscale 4,nop,nop,TS val 903715059 ecr 0,sackOK,eol], length 0</p>
<p style="font-family:arial,sans-serif;font-size:13px">03:48:39.638357 IP x.x.x.5.53663 > 200.8.57.5.80: Flags [S], seq 2084747082, win 65535, options [mss 1440,sackOK,eol], length 0</p><p style="font-family:arial,sans-serif;font-size:13px">
03:48:48.030197 IP x.x.x.5.53663 > 200.8.57.5.80: Flags [S], seq 2084747082, win 65535, options [mss 1440,sackOK,eol], length 0</p><p style="font-family:arial,sans-serif;font-size:13px">^C</p><p style="font-family:arial,sans-serif;font-size:13px">
9 packets captured</p><p style="font-family:arial,sans-serif;font-size:13px">9 packets received by filter</p><p style="font-family:arial,sans-serif;font-size:13px">0 packets dropped by kernel</p><p style="font-family:arial,sans-serif;font-size:13px">
Debug when trying:</p><p style="font-family:arial,sans-serif;font-size:13px">telnet <a href="http://www.inter.com.ve/" target="_blank">www.inter.com.ve</a> 80</p><p style="font-family:arial,sans-serif;font-size:13px">Trying 200.8.57.5...</p>
<p style="font-family:arial,sans-serif;font-size:13px">Its not responding to syn packets, but I'm lost what I need to do to fix this.</p><p style="font-family:arial,sans-serif;font-size:13px">About trafficserver, I'm using their guide <a href="http://docs.trafficserver.apache.org/en/latest/admin/transparent-proxy/router-inline.en.html" target="_blank">http://docs.trafficserver.apache.org/en/latest/admin/transparent-proxy/router-inline.en.html</a></p>
<p style="font-family:arial,sans-serif;font-size:13px">Any help?</p><p style="font-family:arial,sans-serif;font-size:13px">Thank you</p></div>
<p style="margin-top: 2.5em; margin-bottom: 1em; border-bottom: 1px solid #000"></p><pre class="k9mail"><hr /><br />tproxy mailing list<br />tproxy@lists.balabit.hu<br /><a href="https://lists.balabit.hu/mailman/listinfo/tproxy">https://lists.balabit.hu/mailman/listinfo/tproxy</a><br /></pre></blockquote></div></body></html>