March 2008 - tproxy - lists.balabit.hu

Re: [tproxy] TPROXY but without bridging?
by admin＠abp.pl 31 Mar '08

31 Mar '08

Hi Dnia Pn Marca 31 2008, 16:51, Laszlo Attila Toth napisał(a): > Ming-Ching Tiew wrote: >> admin(a)abp.pl wrote: >>> I'm using Squid Cache: Version 2.6.STABLE18 >>> >>> Is there posibility to use it as fully transprent proxy (with tproxy) >>> but >>> without bridging interfaces? >>> >>> My topology: >>> >>> [router 0]---[Internet] >>> | >>> | >>> [===switch=======================] >>> | | | >>> [squid] [ router a ][ router b ] ..... >>> >>> to routers a,b... are connected clients. On that routers I have DNAT >>> --to-destiation squid:80 >>> >>> On squid machine i have 2.6.25-rc7 kernel and Squid with patches from >>> http://people.balabit.hu/panther/tproxy/. > > The official site is http://www.balabit.com/downloads/files/tproxy/, any > other address is used for development. > > The latest squid patch, for version 3 is the following: > > http://www.balabit.com/downloads/files/tproxy/tproxy-squid-3-20080401.patch > > It is not yet finished (the outgoing packets have the squid's IP address > and not the client's). But this patch "tproxy-squid-2.6-STABLE18.20080304-110716-1204625236.patch" isn't working correct? I don't want squid3. I need only one feature, transparent squid with outgoing traffic with client IP addresses. >>> >>> And: >>> iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY \ >>> --tproxy-mark 0x1/0x1 -on-port 3128 >>> iptables -t mangle -N DIVERT >>> iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT >>> iptables -t mangle -A DIVERT -j MARK --set-mark 1 >>> iptables -t mangle -A DIVERT -j ACCEPT >>> ip rule add fwmark 1 lookup 100 >>> ip route add local 0.0.0.0/0 dev lo table 100 >>> >>> squid.conf: >>> .. >>> http_port 3128 transparent tproxy > > > In squid.conf use the following: > > http_port 3128 tproxy > > No more change is necessary (except ACL). > >>> >>> When I test this configuration webservers logs connection from clients >>> from routers a,b... with ip of squid machine. So tproxy doesnt' work. >>> >>> Can I fix it? > > The patch doesn't resolve this problem yet, sorry. :/ So there is no way to transparent proxy clients request on squid 2.6 and kernels above 2.6.22? >>> >>> PS. It's urgent for me, please help;) >>> Regards, >>> Tomasz >>> >>> >> Well among all things you have at least gotten to patch >> the 2.6.25-rc7 kernel. Good ! That's a big step better than >> just ***STARE*** at the patch and refuse to use use it and >> then start asking all sorts of question about where is the >> correct patch ! >> >> :-) > > ... and for which kernel version. Earlier than 2.6.22 will not be > supported. But I'm not sure which kernels are used because I have to > backport tproxy for them. I need kernel newer then 2.6.22, Squid 2.6-stable18 and tproxy-X with full transparent traffic through squid. Regards, -- Tomasz

1 0

TPROXY but without bridging?
by admin＠abp.pl 31 Mar '08

31 Mar '08

Hello, I'm using Squid Cache: Version 2.6.STABLE18 Is there posibility to use it as fully transprent proxy (with tproxy) but without bridging interfaces? My topology: [router 0]---[Internet] | | [===switch=======================] | | | [squid] [ router a ][ router b ] ..... to routers a,b... are connected clients. On that routers I have DNAT --to-destiation squid:80 On squid machine i have 2.6.25-rc7 kernel and Squid with patches from http://people.balabit.hu/panther/tproxy/. And: iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY \ --tproxy-mark 0x1/0x1 -on-port 3128 iptables -t mangle -N DIVERT iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT iptables -t mangle -A DIVERT -j MARK --set-mark 1 iptables -t mangle -A DIVERT -j ACCEPT ip rule add fwmark 1 lookup 100 ip route add local 0.0.0.0/0 dev lo table 100 squid.conf: .. http_port 3128 transparent tproxy tcp_outgoing_address [machine ip] .. When I test this configuration webservers logs connection from clients from routers a,b... with ip of squid machine. So tproxy doesnt' work. Can I fix it? PS. It's urgent for me, please help;) Regards, Tomasz -- Tomasz Kolaj Administrator sieci ABP Computer

3 2

Need Help
by Adnan Shahzad 15 Mar '08

15 Mar '08

Dear Sir, i am working in a company, Pakistan. My Network setting is Squid Machine -------> Packeeter (Hardware for Bandwidth Management (With out NATing)) ---------> F5 (aggreated internet connection (With out NATing) ) --------> Router (NATing) i want to configure Squid with dansguardian for content filter. but problem which i am facing is that squid do NAT and don't forward Client IP. Which i want to forward client IP to Packeeter and squid do cache, log and content filtering job. But i am facing this problem and i study lots of Document and no success so Please guide me and Help me to resolve this problem. looking forward to your positive response. Regards ------------------------------------ M.Adnan Shahzad System Administrator

1 0

tutorial
by Emerson Gregorio 13 Mar '08

13 Mar '08

Good morning! First, sorry for using Google Translator. I am new in the world linux, but with doing some things like compiling kernel. After they discovered the Tproxy and believe that it will help me in my save bandwidth provider of internet and also pass the ip's worth of customers. I have some time trying to work, but could not yet. The documentation that could find is very simple or for advanced users. If anyone can help me and I spend a more detailed tutorial with the options I need to compile the kernel, I doubt that I will achieve the installation. Sincerely,

1 0

openSUSE 10.3 + squid + tproxy
by Adi Nugroho 13 Mar '08

13 Mar '08

Dear all, I tried to instal openSUSE 10.3 + squid + tproxy, but don't know how to start. Is there a howto/tutorial how to set up squid in openSUSE 10.3 with tproxy? Or is there a precompiled kernel, iptables and squid with tproxy for opensuse 10.3? Thank you in advance. -- Salam, Adi Nugroho - http://adi.internux.co.id/ iNterNUX --- http://www.internux.net.id/ Jalan Dr. Sam Ratulangi No. 53J Makassar Tel. +62-411-834690 Fax. +62-411-834691 CDMA:+62-411-6109535 GSM:+62-816-27-9193

4 4

Help Tproxy
by Rosauro - RLINE 12 Mar '08

12 Mar '08

Hello, Need help to put the wheel with the TPROXY Squid 2.6, and that has repasse of ip's worth of customers to the Internet. I am using Kernel 2.6.22.1, installed the patch of TPROXY 4, which is composed of 13 patches. Recompiled the kernel, applied the patch in the iptables 1.3.8 and also applied the patch in Squid 2.6.18. The modules manually uploaded the way Modprobe ipt_TPROXY Modprobe iptable_tproxy My squid.conf set the http_port 3128 tproxy transparent But the rules of iptables, which comes with the README TPROXY, not work, the first rule seems to be wrong and the second not the mistake, but not working. The rules of the readme are these: Iptables-t nat-A PREROUTING-j DNAT - to-dest <localip> - to-port 3128 Iptables-t tproxy-A PREROUTING-j TPROXY - on-port 3128 Also tested with this: Iptables-t tproxy-A PREROUTING-p tcp - dport 80-j TPROXY - on-port 3128 In this case, the packages are accounted for in this rule, but not ai the traffic passing through proxy. Someone could give me a hint of where this the problem? Thanks Rosauro Baretta

1 0

tproxy equivalent for Solaris
by Pranav Desai 12 Mar '08

12 Mar '08

Hello All, Does anyone know of any equivalent of tproxy for solaris platform. Thanks -- Pranav

2 2

Re: [tproxy] Squid with tproxy extra brief FAQ - take 3
by Eduardo Schoedler 10 Mar '08

10 Mar '08

Hello Arun! The access from inside my squid/tproxy box aren't shown in squid log files. I've tried your iptable rule, but has'nt worked. My box have a real IP (internet IP) in the bridge. I can't undersand why it isn't working... The squid works well, and my clients too. Thanks! Best Regards, Eduardo Schoedler. -------------------------------------------------- From: "Arun Srinivasan" <hi2arun(a)gmail.com> Subject: Re: [tproxy] Squid with tproxy extra brief FAQ - take 3 Hi, First make sure that the packets are going with source IP 127.0.0.1. If yes, then add the following rule: $ iptables -t nat -I POSTROUTING -o <outgoing_interface> -s 127.0.0.1 -j MASQUERADE If your packets are not going our with source IP 127.0.0.1, we may need to investigate Squid/other logs. HTH On 08/03/2008, Eduardo Schoedler <eschoedler(a)viavale.com.br> wrote: > Hi Arun! > > Thanks for the answer. > How can I do this ? > It must be done in tproxy table in iptables? > > Thanks! > > Best Regards, > > Eduardo Schoedler. > > > > -------------------------------------------------- > From: "Arun Srinivasan" <hi2arun(a)gmail.com> > Subject: Re: [tproxy] Squid with tproxy extra brief FAQ - take 3 > > > HTTP packets from localhost with Squid + Tproxy support would go out > with source 127.0.0.1. You may need to masquerade. > > On 07/03/2008, Eduardo Schoedler <eschoedler(a)viavale.com.br> wrote: > > Just one thing I've forgot... > > Why can't I download from inside my linux/tproxy/squid box ? > > > > > > # wget http://gentoo.osuosl.org/snapshots/portage-20080229.tar.bz2 > > --19:59:40-- > http://gentoo.osuosl.org/snapshots/portage-20080229.tar.bz2 > > => `portage-20080229.tar.bz2' > > Resolving gentoo.osuosl.org... 140.211.166.134 > > Connecting to gentoo.osuosl.org|140.211.166.134|:80... failed: > Connection > > timed out. > > Retrying. > > > > --19:59:43-- > http://gentoo.osuosl.org/snapshots/portage-20080229.tar.bz2 > > (try: 2) => `portage-20080229.tar.bz2' > > Connecting to gentoo.osuosl.org|140.211.166.134|:80... > > > > > > Here's my ebtables rules: > > > > Bridge chain: BROUTING, entries: 2, policy: ACCEPT > > -p IPv4 -i eth1 --ip-proto tcp --ip-dport 80 -j > > > edirect --redirect-target > > DROP > > -p IPv4 -i eth0 --ip-proto tcp --ip-sport 80 -j > > > edirect --redirect-target > > DROP > > > > > > ... and here my iptables rules: > > > > Chain PREROUTING (policy ACCEPT) > > target prot opt source destination > > TPROXY tcp -- anywhere anywhere tcp > dpt:http > > TPROXY redirect 0.0.0.0:3128 > > > > Any idea? > > > > Thanks in advance. > > > > Best Regards, > > > > > > Eduardo Schoedler.

1 1

icmp support for tproxy 2.0.6 (linux 2.6.20)
by Samuel B 10 Mar '08

10 Mar '08

Hi, i've created a quick patch against TPROXY 2.0.6 adding ICMP protocol support to it. Special thing about this patch, is that it doesn't only rewrites destination of ICMP packet, but also payload of this packet (usually a TCP/UDP packet). Our primary motivation for implementing this is to enable PMTU discovery work for transparent network proxies that are invisible on network, and that make tproxy connections to remote hosts. So with rule like this: iptables -t tproxy -A PREROUTING -p icmp --icmp-type fragmentation-needed \ -m u32 --u32 "48&0xffff=80" -j TPROXY --on-ip 1.1.1.1 --on-port 0 one can redirect fragmentation-needed icmp packets sent as a reply to connection to port 80 with too big MTU, to kernel and that will handle it and adjust PMTU for given connection. I hope someone will help this. When we upgrade to newer tproxy I'll possibly create patch for it (and maybe it will be more intelligent ;-) Sam

2 1

Re: [tproxy] Squid with tproxy extra brief FAQ - take 2
by Eduardo Schoedler 07 Mar '08

07 Mar '08

Thanks for the FAQ. I'm using the (B) Version Tproxy 4.0.x. However, I haven't found the patch for squid in the site http://www.balabit.hu/downloads/files/tproxy/. I'm using SQUID-2.6.17 with "--enable-linux-tproxy". But this compile options activates suppor for tproxy2 instead tproxy4.0.x, right ? How can I found the patch ? Thanks in advance! Best Regads, Eduardo Schoedler. -------------------------------------------------- From: "Ming-Ching Tiew" <mingching.tiew(a)redtone.com> Subject: [tproxy] Squid with tproxy extra brief FAQ - take 2 1. There are at least 3 different versions of tproxy kernel patches. Each tproxy kernel patch is quite strongly tied to a kernel version, (A) Version Tproxy2 ============= For kernel 2.6.18 URL: http://www.balabit.hu/downloads/files/tproxy/obsolete/ (B) Version Tproxy 4.0.x ================ For kernel 2.6.22 URL: http://www.balabit.hu/downloads/files/tproxy/ (C) Version Tproxy-4.1.0 ================= For kernel 2.6.25 URL: The "official website" is for kernel <=2.6.24 http://people.netfilter.org/hidden/tproxy but the actual version of tproxy 4.1 for 2.6.25 is here: http://people.balabit.hu/panther/tproxy The kernel patch might work with nearby kernel versions, for example, tproxy2 might work with kernel 2.6.19; however it will not work will kernel 2.6.22 ( unless you port it ). 2. Do not confuse tproxy kernel patch mentioned above with squid user-space patches. So far the Squid ( 3.0 and 2.6 ) is only supporting on tproxy2 - the userspace code is integrated. If you managed to compile Squid without changing the source, perhaps with only minor changes in header files, meaning you are likely either did not successfully link in tproxy support or at best it is using tproxy2, and it will not work with tproxy-4.0.x and tproxy-4.1.0 kernel counterpart. However, if you patch the squid source, you should be able to get squid to work with tproxy-4.0.x and tproxy-4.1.0. You can look through the archive of this maillist to look at how to port squid versions to support tproxy-4.0.x and tproxy-4.1.0. Most of the patches floating around are not fully satisfactory, but it could work, at least; but perhaps it will require you to have some programming knowledge. Here maybe a good start :- 3. All the tproxy kernel patches are not compatible with one another. Each requires it's own way of setup and usage. So before doing anything, check if you have gotten the correct info/tproxy version/patches. These are some of the info :- (A) Version Tproxy2 ============ The Squid documentation recommends this :- ebtables -t broute -A BROUTING -p ipv4 --ip-protocol tcp \ --ip-destination-port 80 -j redirect --redirect-target ACCEPT This rule will "broute" bridge traffic from br0 to netfilter. The iptables rule will bring http traffic into local process :- iptables -t tproxy -A PREROUTING -i br0 -p tcp --dport 80 \ -j TPROXY --on-port 3128 To get SNAT working for tproxy2, there is a need for double NAT, and here was the discussion and patch :- https://lists.balabit.hu/pipermail/tproxy/2007-October/000537.html (B) Version tproxy-4.0.x ================ Requires additional patches for SNAT and FWMARK. Some hurdles with bridge. Bridge problem is to do with packets must be marked PACKET_HOST when heading for br0 as discussed in this tproxy maillist. There have been people saying they will post the patch for it but yet to date, there is none. This problem can be worked around by brouting the traffic into the real devices instead of br0 :- INSIDE_DEV=eth0 OUTSIDE_DEV=eth1 ebtables -t broute -A BROUTING -i $INSIDE_DEV -p ipv4 \ --ip-protocol tcp --ip-destination-port 80 \ -j redirect --redirect-target DROP ebtables -t broute -A BROUTING -i $OUTSIDE_DEV -p ipv4 \ --ip-protocol tcp --ip-source-port 80 \ -j redirect --redirect-target DROP Please note for real interfaces, it's redirect-target DROP and not redirect-target ACCEPT, while doing it on br0, it's redirect-target ACCEPT ! Remember to adjust your iptables rule accordingly since now packets entering and leaving real interfaces instead of br0. Example :- iptables -t tproxy -A PREROUTING -i $INSIDE_DEV \ -p tcp --dport 80 -j TPROXY --on-port 3128 For tproxy-4.0.3 remember to apply the additional kernel patches mentioned in this maillist or else the kernel will panic accessing null pointer. (C) Version tproxy-4.1.0 ================ The ebtables/bridge notes above is equally applicable. However the iptables rules are totally different. Something like this will be required :- iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY \ --tproxy-mark 0x1/0x1 -on-port 3128 iptables -t mangle -N DIVERT iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT iptables -t mangle -A DIVERT -j MARK --set-mark 1 iptables -t mangle -A DIVERT -j ACCEPT ip rule add fwmark 1 lookup 100 ip route add local 0.0.0.0/0 dev lo table 100 _______________________________________________ tproxy mailing list tproxy(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/tproxy

5 16