May 2008 - tproxy - lists.balabit.hu

Iptables rules
by Ritter, Nicholas 03 Jun '08

03 Jun '08

What exactly are the redirection rules for wccp/iptables 1.4/squid 2.6/tproxy look like? I have browsed the Internet plus messed with it for a while now and found that the README rules don't fully work, and the examples on the Internet don't fully work. Symptomatically, I see the router redirecting via the GRE tunnel, the squid box sees the gre packets (2.6 kernel), but ifconfig does not show the GRE interface counters incrementing, and the squid service run in debug mode shows no transactions. Something is wrong with either my iptables rules or my GRE tunnel setup. I don't think it is the GRE tunnel because I set it up the same exact was as I did the non-tproxy squid boxes that I have in the same setup which are working. Any help would be a appreciated. I can provide my rule setup, etc. if needed. My knowledge and direct interaction is limited with iptables, which is one more reason why I think the problem is there. BTW - my system log does show the tproxy module loading. Nick

3 2

SQUID 3.1 and TPROXY
by Anton 03 Jun '08

03 Jun '08

Dear Laszlo, Just a little confulsed with your statement (below) on the squid 3.1 wiki - does that mean that TPROXY in 3.1 is non usable yet? --- from squid wiki - Feature: TPROXY Update "It is not yet finished, the squid proxy doesn't bind to the client's address. Furthermore I think it would be better to have a different option for this, and "tproxy" wouldn't imply this." Regards, Anton.

3 7

iptables setup for Zorp
by Tim Feld 29 May '08

29 May '08

Hi, I am having difficulties to transfer the zorp tutorial iptables setup to the new tproxy version without the tproxy table. This is the setup in iptables-save/restore syntax found at balabit's website (https://www.balabit.com/network-security/zorp-gateway/gpl/tutorial/) *tproxy :PREROUTING ACCEPT :OUTPUT ACCEPT :PRintra - :PRinter - :PRdmz - -A PREROUTING -i IFintra -j PRintra -A PREROUTING -i IFinter -j PRinter -A PREROUTING -i IFdmz -j PRdmz // PRintra chain -A PRintra -p tcp --dport 80 -j TPROXY --on-port 50080 -A PRintra -p tcp --dport 443 -j TPROXY --on-port 50443 -A PRintra -p tcp --dport 21 -j TPROXY --on-port 50021 // PRinter chain -A PRinter -p tcp --dport 80 -j TPROXY --on-port 50080 // PRdmz chain // no services permitted COMMIT *filter :INPUT DENY :FORWARD DENY :OUTPUT ACCEPT :noise - :spoof - :spoofdrop DROP :LOintra - :LOinter - :LOdmz - -A INPUT -j noise -A INPUT -j spoof // permit all traffic initiated by transparent proxies -A INPUT -m tproxy -j ACCEPT // // permit all TCP traffic initiated by local processes, or allowed by rules // below, we don't trust the state match for UDP traffic, they will be handled // by individual rules below. // -A INPUT -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT // permit all loopback traffic -A INPUT -i lo -j ACCEPT -A INPUT -i IFintra -j LOintra -A INPUT -i IFinter -j LOinter -A INPUT -i IFdmz -j LOdmz -A INPUT -j DROP -A FORWARD -j LOG --log-prefix "FORWARD DROP: " -A FORWARD -j DROP // LOintra -A LOintra -p udp --dport 53 -j ACCEPT -A LOintra -p udp --dport 123 -j ACCEPT -A LOintra -p tcp --syn --dport 25 -j ACCEPT -A LOintra -j LOG --log-prefix "LOintra DROP: " -A LOintra -j DROP // LOinter // permit DNS replies, bind is configured to send out DNS packets from this // port. We could also use the state match in our INPUT chain. -A LOinter -p udp -s DNS_SERVERS --dport 53000 -j ACCEPT -A LOinter -p udp -s NTP_SERVERS --dport 123 -j ACCEPT -A LOinter -p tcp --syn --dport 25 -j ACCEPT -A LOinter -j LOG --log-prefix "LOinter DROP: " -A LOinter -j DROP // LOdmz -A LOdmz -p udp --dport 53 -j ACCEPT -A LOdmz -p udp --dport 123 -j ACCEPT -A LOdmz -p tcp --syn --dport 25 -j ACCEPT -A LOdmz -j LOG --log-prefix "LOdmz DROP: " -A LOdmz -j DROP // // noise chain, should drop all packets which need not be logged, // otherwise it should return to the main ruleset // -A noise -p udp --dport 137:139 -j DROP -A noise -j RETURN // // spoof chain, should drop all packets with spoofed source address // otherwise it should return to the main ruleset // -A spoof -i lo -j RETURN -A spoof ! -i lo -s 127.0.0.0/8 -j spoofdrop -A spoof -i IFintra ! -s NETintra -j spoofdrop -A spoof ! -i IFintra -s NETintra -j spoofdrop -A spoof -i IFdmz ! -s NETdmz -j spoofdrop -A spoof ! -i IFdmz -s NETdmz -j spoofdrop -A spoof -j RETURN // -A spoofdrop -j LOG --log-prefix "Spoofed packet: " -A spoofdrop -j DROP COMMIT I tried to do the tproxy table stuff in mangle but did not succeed. All packets are dropped. Apart from that I do not know how to replace -A INPUT -m tproxy -j ACCEPT. I really hope someone can help me. Thanks Tim -- Der GMX SmartSurfer hilft bis zu 70% Ihrer Onlinekosten zu sparen! Ideal für Modem und ISDN: http://www.gmx.net/de/go/smartsurfer

2 1

tproxy for UDP
by Ravi Valmikam 29 May '08

29 May '08

I have a tproxy setup with linux 2.6.24 (Ubuntu 8.04 Hardy) that I have been using successfully for a TCP proxy scenario. When I use the same setup for UDP scenario, I am having trouble with sendto() function. Here is what I am doing: - Create a UDP socket - Set IP_TRANSPARENT flag (19) - Bind to a foreign IP address and port# All of the above steps work OK. "netstat -an" confirms that the udp socket is indeed bound to the foriegn address. However, when I do a sendto() to another host, the sendto() call fails with EINVAL. I have ensured that my code is correct by using the same code with bind() to a local address. It works OK. I did look at the net/socket.c net/ipv4/udp.c and none of the EINVAL scenarios seem to obviously apply. Can someone help me out on this one? Did anyone see this issue before? Thanks Ravi

1 0

iptables, kernel insmod problem
by Ritter, Nicholas 23 May '08

23 May '08

I have a CentOS 5.1 box which I have custom compiled iptables and a kernel on. The version I am using are iptables 1.4.0, kernel 2.6.25.4, and tproxy (specifically: tproxy-iptables-1.4.0-20080521-113954-1211362794.patch, and tproxy-kernel-2.6.25-20080519-165031-1211208631.tar.bz2 ) The problem I am having is that when I issue an iptables command to create a TPROXY rule, itpables errors saying that it can't initialize the TPROXY table. Normal I would assume that I had problems with the patches, compiling, etc. Everything patched cleanly, compiled fine, and installed fine. When I searched, I see the compiled libxt_TPROXY and xt_TPROXY.ko files in iptables build directory and the kernel modules directory. Isnmod xt_TROXY does not work. I must have done something wrong somewhere, can someone offer so suggestions? Nick

2 1

Trouble getting server side transparency to work
by Ravi Valmikam 22 May '08

22 May '08

I am using the following versions of software: - Ubuntu 8.04 (Linux 2.6.24-14) Base Kernel - tproxy-2.6.24-20080509 patch (tproxy-kernel-2.6.24-20080509-164556-1210344356.tar.bz2) - iptables 1.4.0 (from netfilter.org website) - tproxy-iptables-svn-r7519-20080509-165158-1210344718.patch I am using the following script to setup the tproxy rules. ==================================== ip rule add fwmark 1 lookup 100 ip route add local 0.0.0.0/0 dev lo table 100 iptables -t mangle -N DIVERT iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT iptables -t mangle -A DIVERT -j MARK --set-mark 1 iptables -t mangle -A DIVERT -j ACCEPT iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 50080 ==================================== The host I am using is running as a router with eth0 connected to internet and eth1 connected to LAN. I have small a tcp proxy program running on this host. I enabled IP_TRANSPARENT on both sides (client side and server side). The client side is working wonderfully fine. It accepts connections from the client (otherwise destined to the real server), can read and write packets through the accepted FD. However, I am having trouble with the server side socket. I successfully bound the socket to a foriegn address (client's ip and port 0) and initiated a connection to the real server. The TCP SYN is going out of the box and SYN ACK is coming in. But this SYN ACK does not make it into the socket layer (or atleast my program) and socket stays in SYN_SENT state until time out. Can you please help me with this? It feels so close but ... Thanks Ravi My iptables output looks like this: ====================== Chain PREROUTING (policy ACCEPT) target prot opt source destination DIVERT tcp -- anywhere anywhere socket TPROXY tcp -- anywhere anywhere tcp dpt:www TPROXY redirect 0.0.0.0:50080 mark 0x1/0x1 Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain POSTROUTING (policy ACCEPT) target prot opt source destination Chain DIVERT (1 references) target prot opt source destination MARK all -- anywhere anywhere MARK set 0x1 ACCEPT all -- anywhere anywhere ==================================== My modules listing looks like this: ==================================== xt_tcpudp 4352 1 xt_MARK 3328 1 xt_multiport 4480 0 xt_socket 4224 1 nf_conntrack 67136 1 xt_socket xt_TPROXY 3712 1 nf_defrag_ipv4 3456 2 xt_socket,xt_TPROXY nf_tproxy_core 5376 2 xt_socket,xt_TPROXY,[permanent] x_tables 16388 6 xt_tcpudp,xt_MARK,xt_multiport,xt_socket,xt_TPROXY,ip_tables ====================================

3 3

Couldn't load match `socket':/usr/local/lib/iptables/libipt_socket.so
by Tim Feld 21 May '08

21 May '08

Hi, i am trying to set up tproxy to use zorp. The tproxy and iptables patches were applied cleanly. I configured the kernel to include netfilter_tproxy, netfilter_xt_target_tproxy and netfilter_xt_match_socket as modules. Compile and install ran fine. But when I try the example commands from the readme I get several error messages as if tproxy is not installed at all. For example: iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --on-port 50080 --tproxy-mark 0x1/0x1 returns: iptables v1.4.0: Unknown arg `--on-port' without the port argument: iptables v1.4.0: Unknown arg `--tproxy-mark' without the tproxy-mark argument: iptables v1.4.0: Couldn't load target `TPROXY':/usr/local/lib/iptables/libipt_TPROXY.so: cannot open shared object file: No such file or directory command: iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT returns: iptables v1.4.0: Couldn't load match `socket':/usr/local/lib/iptables/libipt_socket.so: cannot open shared object file: No such file or directory Why is it looking for libipt_TPROXY.so and libipt_socket.so? As far as I know in the newer releases there is just xt_TPROXY respectively xt_socket. My setup: Kernel: (Ubuntu) 2.6.24-16-xen, tried 2.6.24.7 from kernel.org too in case the xen patches cause the trouble tproxy: tproxy-2.6.24-20080509 iptables: 1.4.0 (from netfilter.org) tproxy-iptables-svn-r7519-20080509-165158-1210344718.patch I also tried to build tproxy into the kernel instead of using modules. Building fails in that case with the following message: net/built-in.o: In function `socket_mt': /usr/src/linux-2.6.24.7/net/netfilter/xt_socket.c:60: undefined reference to `nf_conntrack_untracked' make[2]: *** [.tmp_vmlinux1] Error 1 make[1]: *** [sub-make] Error 2 I have attached the network part of both kernel configs. I guess I must be missing something. Any help is greatly appreciated! Tim -- Psssst! Schon vom neuen GMX MultiMessenger gehört? Der kann`s mit allen: http://www.gmx.net/de/go/multimessenger

2 2

Is there a usable TPROXY4+squid+linuxKernel patches?
by Anton VG 20 May '08

20 May '08

Hello! Just confused with some staff and can't find answers myself, decided to finally ask here ;) I'm an old user of -tproxy for over than 3 years now, and used the first -tproxy with SQUID 2.4STABLE5 for a long while before upgrading to squid 2.6stable18 recently - but after a few months of use - I found that -tproxy patched kenel+SQUID2.6STABLE_X influences weirdly (inserts delay up to several seconds!) on the any transit traffic (kernel ip stack???) when it get's hit by certain type of traffic on the proxy-redirect port (I pcap-ed the weird traffic - but did not udertood yet why it has such impact) - and had to disable PROXY entirely on the transit cache and wait for next usable version to try. But still cannot find what version I could try on the production cache... For a 2 last monthes periodically looking at the http://www.balabit.com/downloads/files/tproxy/ frequently saw a newer versions pf patches, but I was never able to cleanly apply any of the patches to any of the corresponding Linux Kernel v 2.6.24 or 2.6.25 and the SQUID-3.0STABLE-X Also even the patch tproxy4-squid-3.0.STABLE4.patch - looks suspicious since does not apply cleanly to any of the SQUID versions 3.0Stable 4 or STABLE5 (below is the patch output) and notes internally to the STABLE6 - which is not yet released (according to the SQUID downloads page) Just please could you point out to the working versions of the tproxy4.1 patches for any of the 2.4.20+ kernels and squid 3.0STABLE_ANY ? Trying patching the kernel - looks I would need corresponding -git development branch - but I'm not so familiar with -git yet. I would be just gratefull if you could point me out to a working versions of patches for TPROXY 4.1 for kernel and squid. Below is my output for trying patching squid Stable4 Kind regards, Anton. -- What i get while trying patching the squid. cacheng:/usr/src/TPROXY4/squid-3.0.STABLE4# patch -p0 < tproxy4-squid-3.0.STABLE4.patch patching file ChangeLog Hunk #1 FAILED at 1. 1 out of 1 hunk FAILED -- saving rejects to file ChangeLog.rej patching file configure.in Reversed (or previously applied) patch detected! Assume -R? [n] y can't find file to patch at input line 83 Perhaps you used the wrong -p or --strip option? The text leading up to this was: -------------------------- | |=== modified file 'doc/release-notes/release-3.0.sgml' |--- doc/release-notes/release-3.0.sgml 2008-04-01 11:51:41 +0000 |+++ doc/release-notes/release-3.0.sgml 2008-04-24 07:39:18 +0000 -------------------------- File to patch: Skip this patch? [y] y Skipping patch. 2 out of 2 hunks ignored patching file src/ACLChecklist.cc patching file src/IPInterception.cc patching file src/IPInterception.h patching file src/cache_cf.cc patching file src/cf.data.pre patching file src/client_side.cc Hunk #1 succeeded at 1792 (offset 2 lines). Hunk #2 FAILED at 1963. Hunk #3 succeeded at 2188 (offset -1 lines). Hunk #4 succeeded at 2705 (offset -1 lines). Hunk #5 succeeded at 3013 (offset -1 lines). Hunk #6 succeeded at 3028 (offset -1 lines). 1 out of 6 hunks FAILED -- saving rejects to file src/client_side.cc.rej patching file src/client_side_request.h patching file src/comm.cc patching file src/fde.h patching file src/forward.cc Hunk #5 succeeded at 833 (offset 2 lines). Hunk #6 FAILED at 870. Hunk #7 succeeded at 1214 (offset -28 lines). 1 out of 7 hunks FAILED -- saving rejects to file src/forward.cc.rej patching file src/forward.h Hunk #1 succeeded at 94 (offset -1 lines). patching file src/globals.h patching file src/http.cc patching file src/structs.h patching file src/tools.cc cacheng:/usr/src/TPROXY4/squid-3.0.STABLE4#

4 14

Tproxy in RHEL 5
by Chandana Weganthale 15 May '08

15 May '08

Hi I needed to install and configure tproxy for my Fedora core 6 and RHEL 5 linux boxes. Squid version is 2.6 stable. Can some body help me to install tproxy for my linux boxes ? Thank you Chandana

1 0

tproxy on ubuntu 8.04 server edition
by chrone 14 May '08

14 May '08

Dear all, I need help on setting tproxy with squid2.6stable18 so that I can set the squidbox to forward client ip source address to mikrotik routeros using the client ip source address not the squidbox ip address. I already patch the kernel 2.6.24 with newest tproxy-kernel. but i didn't know how to go on after the patches. I'm sorry for this foolish question, since I'm really newbie in networking. -- everytime i get ahead, i feel more dead.

1 0