May 2007 - tproxy - lists.balabit.hu

Re: [tproxy] Tproxy + squid + Wccp verion 2 + FC5 Does it really work
by Logu 29 May '07

29 May '07

> Dear Logu, > > Currently my setup is as follows : - > > Wan Link Coming in my router --> With 2 Ethernet Port > E0/1 ------> Connected to my squid with a valid > Public IP > My Squid has only 1 Interface > configured, with no outgoing address in squid.conf > Wccp2_router & subsequent > parameters, my router detects my wccp squid verywell > E0/0 ------> Connected to my local lan > with valid public IP > I have configured the Gre tunnel and set all the parameters correct on my > linux box. I am not sure if this is the correct bi-directional path. > >>From what I read and understand I might be wrong "please correct" this is > what u mean: > Wan-->Router--->squid with 2 interface ---> My Linux box (gateway) ---> > client ? Nevermind about the bidirectional flow, I missed your WCCP setup during my initial post. Since you are using WCCP and gre tunnel both incoming and outgoing traffic should go through squid box. The culprit should be the "outgoing address", set the outgoing IP address (same as the IP of the box) and it should work for you. And infact the error does mean it. -logu

1 0

[Fwd: RE: [tproxy] Tproxy + squid + Wccp verion 2 + FC5 Does it really work]
by Balazs Scheidler 28 May '07

28 May '07

forgot to cc the list with the answer. -- Bazsi

1 0

Tproxy + squid + Wccp verion 2 + FC5 Does it really work
by Rajesh Yadav 28 May '07

28 May '07

Hello, I had been struggling for almost a month trying to make tproxy + Squid + Wccp work for me but all my effort gives me only "2007/05/28 11:50:30| tproxy ip=xxx.xxx.xxx.xxx,0x2e11c87a,port=0 ERROR ASSIGN". And I can only see my squid ip with www.dnsstuff.com & www.tracert.com. Please can anyone help me with the correct method & steps to make it work for me ? Regards Rajesh -----Original Message----- From: tproxy-bounces(a)lists.balabit.hu [mailto:tproxy-bounces@lists.balabit.hu] On Behalf Of tproxy-request(a)lists.balabit.hu Sent: Sunday, May 27, 2007 3:30 PM To: tproxy(a)lists.balabit.hu Subject: tproxy Digest, Vol 23, Issue 5 Send tproxy mailing list submissions to tproxy(a)lists.balabit.hu To subscribe or unsubscribe via the World Wide Web, visit https://lists.balabit.hu/mailman/listinfo/tproxy or, via email, send a message with subject or body 'help' to tproxy-request(a)lists.balabit.hu You can reach the person managing the list at tproxy-owner(a)lists.balabit.hu When replying, please edit your Subject line so it is more specific than "Re: Contents of tproxy digest..." Today's Topics: 1. Re: The future of tproxy (Jan Engelhardt) 2. Re: The future of tproxy (Igmar Palsenberg) 3. Re: The future of tproxy (Jan Engelhardt) 4. Re: The future of tproxy (Balazs Scheidler) ---------------------------------------------------------------------- Message: 1 Date: Sat, 26 May 2007 21:16:38 +0200 (MEST) From: Jan Engelhardt <jengelh(a)linux01.gwdg.de> Subject: Re: [tproxy] The future of tproxy To: Balazs Scheidler <bazsi(a)balabit.hu> Cc: Nicholas George <nick.george(a)gmail.com>, tproxy(a)lists.balabit.hu Message-ID: <Pine.LNX.4.61.0705262114160.7344(a)yvahk01.tjqt.qr> Content-Type: TEXT/PLAIN; charset=US-ASCII On May 26 2007 07:36, Balazs Scheidler wrote: >> >> What are your future plans for TPROXY? I noticed that there's no plan >> for NAT in ipv6tables, so are you looking to move away from a NAT >> approach? Are you considering migrating towards Network Channels? > >We definitely want to move away from NAT, and we don't plan to migrate >towards network channels. (at least for now). But how is one supposed to fake addresses then? -- most prominent case: squid Jan -- ------------------------------ Message: 2 Date: Sat, 26 May 2007 22:32:06 +0200 (CEST) From: Igmar Palsenberg <maillist(a)jdimedia.nl> Subject: Re: [tproxy] The future of tproxy To: Jan Engelhardt <jengelh(a)linux01.gwdg.de> Cc: Balazs Scheidler <bazsi(a)balabit.hu>, Nicholas George <nick.george(a)gmail.com>, tproxy(a)lists.balabit.hu Message-ID: <Pine.LNX.4.64.0705262231210.30518(a)jdi.jdi-ict.nl> Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed >> We definitely want to move away from NAT, and we don't plan to migrate >> towards network channels. (at least for now). > > But how is one supposed to fake addresses then? By bind()'ing to the remote address, like the way it was done in the Linux 2.2 days. Igmar ------------------------------ Message: 3 Date: Sat, 26 May 2007 22:45:19 +0200 (MEST) From: Jan Engelhardt <jengelh(a)linux01.gwdg.de> Subject: Re: [tproxy] The future of tproxy To: Igmar Palsenberg <maillist(a)jdimedia.nl> Cc: Balazs Scheidler <bazsi(a)balabit.hu>, Nicholas George <nick.george(a)gmail.com>, tproxy(a)lists.balabit.hu Message-ID: <Pine.LNX.4.61.0705262244270.7344(a)yvahk01.tjqt.qr> Content-Type: TEXT/PLAIN; charset=US-ASCII On May 26 2007 22:32, Igmar Palsenberg wrote: >> > We definitely want to move away from NAT, and we don't plan to migrate >> > towards network channels. (at least for now). >> >> But how is one supposed to fake addresses then? > > By bind()'ing to the remote address, like the way it was done in the Linux 2.2 > days. Yeah but you'd still need a local table that lists tproxied sockets, so that for an arbitrary incoming packet it can be decided whether it is to go through the INPUT or FORWARD chain (and subsequently, destination program/host). Jan -- ------------------------------ Message: 4 Date: Sun, 27 May 2007 00:19:43 +0200 From: Balazs Scheidler <bazsi(a)balabit.hu> Subject: Re: [tproxy] The future of tproxy To: Jan Engelhardt <jengelh(a)linux01.gwdg.de> Cc: Igmar Palsenberg <maillist(a)jdimedia.nl>, Nicholas George <nick.george(a)gmail.com>, tproxy(a)lists.balabit.hu Message-ID: <1180217983.19697.33.camel(a)bzorp.balabit> Content-Type: text/plain On Sat, 2007-05-26 at 22:45 +0200, Jan Engelhardt wrote: > On May 26 2007 22:32, Igmar Palsenberg wrote: > >> > We definitely want to move away from NAT, and we don't plan to migrate > >> > towards network channels. (at least for now). > >> > >> But how is one supposed to fake addresses then? > > > > By bind()'ing to the remote address, like the way it was done in the Linux 2.2 > > days. > > Yeah but you'd still need a local table that lists tproxied sockets, so > that for an arbitrary incoming packet it can be decided whether it is > to go through the INPUT or FORWARD chain (and subsequently, destination > program/host). The local table is the "socket hash". We do a socket lookup early in the input path and divert the packet to the local IP stack by changing its dst_entry. -- Bazsi ------------------------------ _______________________________________________ tproxy mailing list tproxy(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/tproxy End of tproxy Digest, Vol 23, Issue 5 *************************************

4 3

The future of tproxy
by Nicholas George 27 May '07

27 May '07

I was just reading the following post: http://news.gmane.org/find-root.php?message_id=%3c20070103163357.14635.3775… regarding TPROXY Version 4. ie NOT using iptables NAT, but being able to bind to a non-local address. The approach discussed in the post looks and sounds good. How close is it to being ready for production use? Do you consider TPROXY Version 2 (the current TPROXY) safe for production use? What are your future plans for TPROXY? I noticed that there's no plan for NAT in ipv6tables, so are you looking to move away from a NAT approach? Are you considering migrating towards Network Channels? Kind Regards, Nick George

4 5

IP_TPROXY: socket already assigned errors
by Lior Dotan 20 May '07

20 May '07

Hi, I've been using TPROXY 2.0.6 + NAT reservation with kernel 2.4.33 and squid with tproxy support and I'm getting a lot of these messages: IP_TPROXY: socket already assigned, reuse=0.... I tried to enable the reuse address but that didn't help. With TPROXY 1.20 I didn't have this problem, but I did have the "error applying NAT" which is the reason that I am using NAT reservation. Another question that I have is the size of the has table, currently squid handles about 100 requests/sec. When should I increase the hash size, if ever? Thanks.

1 0

Debian K2.6 + wccp + tproxy squid 2.6 stable15
by Nicolas Royo 17 May '07

17 May '07

Hi fellows, hope you can help me out with a problem im still having. The problem is quite simple and complicated we are on a small isp, trying to implement squid without "the user noticing it" we´ve come very far reading your lists and googling squids tproxy. on a linux box, only one eth0, with a gre0, with a cisco 7200. kernel and iptables patched with lasts cttproxys :D iptables -L -t tproxy Chain PREROUTING (policy ACCEPT) target prot opt source destination TPROXY tcp -- anywhere anywhere tcp dpt:www TPROXY redirect 0.0.0.0:3128 > #####squid Conf.##### > http_port 3128 tproxy transparent > hierarchy_stoplist cgi-bin ? > acl QUERY urlpath_regex cgi-bin \? > cache deny QUERY > acl apache rep_header Server ^Apache > broken_vary_encoding allow apache > access_log /usr/local/squid/var/logs/access.log > squid > refresh_pattern ^ftp: 1440 20% 10080 > refresh_pattern ^gopher: 1440 0% 1440 > refresh_pattern . 0 20% 4320 > acl all src 0.0.0.0/0.0.0.0 > acl manager proto cache_object > acl localhost src 127.0.0.1/255.255.255.255 > acl Safe_ports port 80 # http > acl Safe_ports port 21 # ftp > acl Safe_ports port 443 # https > acl Safe_ports port 70 # gopher > acl Safe_ports port 210 # wais > acl Safe_ports port 1025-65535 # unregistered ports > acl Safe_ports port 280 # http-mgmt > acl Safe_ports port 488 # gss-http > acl Safe_ports port 591 # filemaker > acl Safe_ports port 777 # multiling http > acl to_localhost dst 127.0.0.0/8 > acl SSL_ports port 443 > acl Safe_ports port 80 # http > acl Safe_ports port 21 # ftp > acl Safe_ports port 443 # https > acl Safe_ports port 70 # gopher > acl Safe_ports port 210 # wais > acl Safe_ports port 1025-65535 # unregistered ports > acl Safe_ports port 280 # http-mgmt > acl Safe_ports port 488 # gss-http > acl Safe_ports port 591 # filemaker > acl Safe_ports port 777 # multiling http > acl CONNECT method CONNECT > http_access allow manager localhost > http_access deny manager > http_access deny !Safe_ports > http_access deny CONNECT !SSL_ports > acl our_networks src 0.0.0.0/0.0.0.0 > http_access allow our_networks > http_access deny all > http_reply_access allow all > icp_access allow all > visible_hostname debian-sq > wccp2_router XXX.XXX.XXX.XXX > wccp_version 4 > wccp2_forwarding_method 1 > wccp2_return_method 1 > wccp2_assignment_method 1 > coredump_dir /usr/local/squid/var/cache > via off > forwarded_for off with this last 2 options, we have played a lot. if set it on, client ip is passing through the squid, url`s like www.whatsmyipadress.com are still detecting a proxy behind it! :( if set off, squid ip is reaching final url, but squid is not being detected. as far as i can tell, is that if i set the parameter: tcp_outgoing_adress x.x.x.x and adding another iptables rule and NIC to the linux box, the requesting page on the client browser "dies" (keeps waiting till it times out( so no tcp_outgoing_adress is have to be set up in order to surf withouth problems BUT if not set up, on syslog and squid.out i can see: squid-RC9 squid[26519]: tproxy ip=[x.x.x.x--->client address here],0xa4e851c8,port=0 ERROR ASSIGN what else should i have to check? there is a hardware solution that has been offered to us.....bluecoat SG.........that is covering all these needs by our boss. but it is a so expensive product in a country like ours (argentina) that we cant afford it...........we bet on tproxy´s magic........we still believe Thanx in advance Nicolas ____________________________________________________________________________________ Moody friends. Drama queens. Your life? Nope! - their life, your story. Play Sims Stories at Yahoo! Games. http://sims.yahoo.com/

1 0