June 2008 - tproxy - lists.balabit.hu

need help with haproxy routing rules
by Jeffrey 'jf' Lim 01 Jul '08

01 Jul '08

hi, folks, I've been scratching my head over this, and need your help with this. I've got haproxy compiled with tproxy support, and it's working fine with regards to point no. 3 ("Initiating connections with a foreign address as a source") - I've got it binding and connecting properly, and it's able to send out packets using a foreign address. Problem now is, when the reply packet comes back, haproxy cant seem to be able to detect it? The route rules in the readme are tuned for a full transparent proxy, listening on another port other than the port of the traffic you want to transparently listen to, which is fine for squid - but this is not what I'm looking for. As far as i've figured, the following rules should work, but dont somehow: ====== iptables -t mangle -N DIVERT iptables -t mangle -A PREROUTING -p tcpo -m socket -j DIVERT iptables -t mangle -A DIVERT -j MARK --set-xmark 0x1/0xffffffff iptables -t mangle -A DIVERT -j ACCEPT ===== The rule iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --on-port <proxyport> --tproxy-mark 0x1/0x1 isn't applicable here, because haproxy IS supposed to be "non-transparent" at the client end - it IS supposed to listen in directly on the ip and port for web traffic - that's the point of a load balancer, so... Could somebody perhaps tell me what i need to complete the setup, and get the packets to be forwarded to haproxy? thanks, -jf -- In the meantime, here is your PSA: "It's so hard to write a graphics driver that open-sourcing it would not help." -- Andrew Fear, Software Product Manager, NVIDIA Corporation http://kerneltrap.org/node/7228

1 1

TPROXY is not working
by Nataniel Klug 26 Jun '08

26 Jun '08

People, I have made everything I told you before but I put an fixed ip into my cache. Its ip is 200.163.208.14 and my clients are all valid ips behind this cache. I am at IP 200.163.208.10 and when I use www.meuip.com.br to discover my ip address i find: Meu ip é *200.163.208.14* *Mais Informações* IP Reverso *200.163.208.14* Data *15h26min - 26/06/2008 * So this is wrong. I have made this scripts into my system: FIREWALL #!/bin/bash #---- # Variaveis de Sistema #---- IPT="/sbin/iptables" RT="/sbin/route" DIR="/etc/firewall" #---- # Regras gerais de tratamento de pacotes #---- $IPT -F $IPT -t nat -F $IPT -t nat -X $IPT -X $IPT -F INPUT $IPT -F FORWARD $IPT -F OUTPUT #---------- # Aceita todas as conexoes do loopback #---------- $IPT -A INPUT -i lo -j ACCEPT $IPT -A FORWARD -i lo -j ACCEPT #---------- # Ping-of-Death, Syn-Flood, Port-Scanner # Permissao de ping para as interfaces locais #---------- $IPT -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT $IPT -A FORWARD -p tcp --syn -m limit --limit 1/s -j ACCEPT $IPT -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT $IPT -A INPUT -p icmp -m limit --limit 1/s -j ACCEPT #---------- # Aceita conexoes estabelecidades #---------- $IPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT $IPT -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT $IPT -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT #---------- # LOG e DROP de pacotes fragmentados #---------- $IPT -A FORWARD -m state --state INVALID -j DROP $IPT -A INPUT -f -j LOG --log-prefix "Pacote INPUT fragmentado: " $IPT -A INPUT -f -j DROP $IPT -A FORWARD -f -j LOG --log-prefix "Pacote FORWARD fragmentado: " $IPT -A FORWARD -f -j DROP #---------- # Declara IP dos Servidores #---------- QOS="200.163.208.2" MAIL="200.163.208.6" CACHE="172.31.0.2" #---------- # Declara redes utilizadas por este cache #---------- V01="200.163.208.0/30" # rede roteador/qos V02="200.163.208.4/30" # rede qos/mail V03="200.163.208.8/30" # rede CNett - Escritorio V04="200.163.208.12/30" # rede qos/cache V05="200.163.208.16/28" # rede RESERVADA V06="200.163.208.32/27" # rede RESERVADA V07="200.163.208.64/26" # rede CLIENTES IP/FIXO (subnets no ptp.mk.elj) V08="200.140.222.128/25" # rede RESERVADA V09="201.35.16.0/24" # rede PPPoE EMA (201.35.16.0/25) e EMS (201.35.16.128/25) V10="200.101.166.0/24" # rede PPPoE ELJ I01="172.31.0.0/30" # rede BACKBONE CNett cache > ptp.mk.elj PTP="172.16.0.0/24" # rede PTP CNett (ELJ>EMA/ELJ>EMS/ELJ>CNETT) (subnets no ptp.mk.elj) APS="10.0.0.0/8" # rede APS (ELJ/EMA/EMS/CNETT) (subnets no ptp.mk.elj) #--------- # Redes com NAT #--------- EMS_LOCAL="192.168.40.0/24" #---------- # Declara rotas para redes distantes #---------- $RT add -net $V03 gw $CACHE $RT add -net $V07 gw $CACHE $RT add -net $V09 gw $CACHE $RT add -net $V10 gw $CACHE $RT add -net $PTP gw $CACHE $RT add -net $APS gw $CACHE $RT add -net $EMS_LOCAL gw $CACHE #---------- # DMZ #---------- #/etc/firewall/dmz #---------- # Regras para funcionamento do Conectividade Social da CEF #---------- #$IPT -t nat -A PREROUTING -d 200.201.166.100 -p tcp --dport 80 -j DNAT --to 200.201.166.100 #$IPT -t nat -A PREROUTING -d 200.201.169.69 -p tcp --dport 80 -j DNAT --to 200.201.169.69 #$IPT -t nat -A PREROUTING -d 200.201.173.68 -p tcp --dport 80 -j DNAT --to 200.201.173.68 #$IPT -t nat -A PREROUTING -d 200.201.174.202 -p tcp -m tcp --dport 80 -j DNAT --to-destination 200.201.174.202:80 #$IPT -t nat -A PREROUTING -d 200.201.174.203 -p tcp -m tcp --dport 80 -j DNAT --to-destination 200.201.174.203:80 #$IPT -t nat -A PREROUTING -d 200.201.174.204 -p tcp -m tcp --dport 80 -j DNAT --to-destination 200.201.174.204:80 #$IPT -t nat -A PREROUTING -d 200.201.174.205 -p tcp -m tcp --dport 80 -j DNAT --to-destination 200.201.174.205:80 #$IPT -t nat -A PREROUTING -d 200.201.174.206 -p tcp -m tcp --dport 80 -j DNAT --to-destination 200.201.174.206:80 #$IPT -t nat -A PREROUTING -d 200.201.174.207 -p tcp -m tcp --dport 80 -j DNAT --to-destination 200.201.174.207:80 #$IPT -t nat -A PREROUTING -d 200.201.174.208 -p tcp -m tcp --dport 80 -j DNAT --to-destination 200.201.174.208:80 #$IPT -t nat -A PREROUTING -d 200.201.174.209 -p tcp -m tcp --dport 80 -j DNAT --to-destination 200.201.174.209:80 #--------- # Regras para acesso direto aos servidores da CNett #--------- #$IPT -t nat -A PREROUTING -d $V01 -j ACCEPT #$IPT -t nat -A PREROUTING -d $V02 -j ACCEPT #--------- # Mascara todas as redes nao roteaveis # que passam por este servidor #--------- #$IPT -t nat -A POSTROUTING -s $EMS_LOCAL -j MASQUERADE # NTP server #$IPT -t nat -A POSTROUTING -d 146.164.53.65 -j MASQUERADE #--------- # Habilita o sistema de cache com TPROXY #--------- /etc/firewall/squid FIREWALL-SQUID #!/bin/bash IP="/sbin/ip" IPT="/sbin/iptables" PROXY_PT="3128" PROXY_MK="1" #---------- # Declara redes utilizadas por este cache #---------- V01="200.163.208.0/30" # rede roteador/qos V02="200.163.208.4/30" # rede qos/mail #---- # Criando as regras de redicionamento dos pacotes # marcados pelo iptables #---- $IP rule add fwmark $PROXY_MK lookup 100 $IP route add local 0.0.0.0/0 dev lo table 100 #---- # Criando as regras do iptables #---- $IPT -t mangle -F $IPT -t mangle -N DIVERT $IPT -t mangle -A PREROUTING -p tcp -m socket -j DIVERT $IPT -t mangle -A DIVERT -j MARK --set-mark 1 $IPT -t mangle -A DIVERT -j ACCEPT #---------- # Regras para funcionamento do Conectividade Social da CEF #---------- $IPT -t mangle -A PREROUTING -d 200.201.166.100 -j ACCEPT $IPT -t mangle -A PREROUTING -d 200.201.169.69 -j ACCEPT $IPT -t mangle -A PREROUTING -d 200.201.173.68 -j ACCEPT $IPT -t mangle -A PREROUTING -d 200.201.174.202 -j ACCEPT $IPT -t mangle -A PREROUTING -d 200.201.174.203 -j ACCEPT $IPT -t mangle -A PREROUTING -d 200.201.174.204 -j ACCEPT $IPT -t mangle -A PREROUTING -d 200.201.174.205 -j ACCEPT $IPT -t mangle -A PREROUTING -d 200.201.174.206 -j ACCEPT $IPT -t mangle -A PREROUTING -d 200.201.174.207 -j ACCEPT $IPT -t mangle -A PREROUTING -d 200.201.174.208 -j ACCEPT $IPT -t mangle -A PREROUTING -d 200.201.174.209 -j ACCEPT #--------- # Regras para acesso direto aos servidores da CNett #--------- $IPT -t mangle -A PREROUTING -d $V01 -j ACCEPT $IPT -t mangle -A PREROUTING -d $V02 -j ACCEPT #---- # Marca os pacotes com destino ao cache #---- $IPT -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port $PROXY_PT So this is doing the redirect stuff into cache (my cache.log is growing fast). I have this config into my squid.conf: http_port 3128 transparent tproxy icp_port 0 cache_mem 64 MB cache_swap_low 92 cache_swap_high 96 maximum_object_size 102400 KB cache_replacement_policy heap LFUDA memory_replacement_policy heap LFUDA cache_dir aufs /cache/00 25000 16 256 cache_dir aufs /cache/01 25000 16 256 cache_dir aufs /cache/02 25000 16 256 cache_dir aufs /cache/03 25000 16 256 cache_store_log none access_log /usr/local/squid/var/logs/access.log squid client_netmask 255.255.255.255 ftp_user squid(a)cnett.com.br diskd_program /usr/local/squid/libexec/diskd unlinkd_program /usr/local/squid/libexec/unlinkd error_directory /usr/local/squid/share/errors/Portuguese dns_nameservers 127.0.0.1 200.163.208.6 dns_testnames www.uol.com.br www.terra.com.br www.cnett.com.br acl manager proto cache_object acl google dstdomain .google.com .orkut.com acl youtube dstdomain .youtube.com acl localhost src 127.0.0.1/32 acl to_localhost dst 127.0.0.0/8 acl QUERY urlpath_regex cgi-bin \? acl SSL_ports port 443 acl Safe_ports port 80 21 443 70 210 280 488 591 777 1025-65535 acl CONNECT method CONNECT acl EMS_PPP_01 src 201.35.16.128/25 acl EMS_NRT_01 src 192.168.40.0/24 acl EMA_PPP_01 src 201.35.16.0/25 acl ELJ_PPP_01 src 200.101.166.0/24 acl V01 src 200.163.208.0/25 http_access allow EMS_PPP_01 http_access allow EMS_NRT_01 http_access allow EMA_PPP_01 http_access allow ELJ_PPP_01 http_access allow V01 http_access allow manager localhost http_access deny manager http_access allow localhost http_access allow to_localhost cache allow google cache allow youtube cache deny QUERY http_access deny !Safe_ports http_access deny CONNECT !SSL_ports http_access deny all icp_access deny all cache_mgr suporte(a)cnett.com.br cache_effective_user squid cache_effective_group squid visible_hostname cache.cnett.com.br unique_hostname cache.cnett.com.br Hope to have some help... -- Att, NATANIEL KLUG nata(a)cnett.com.br LEIA O DIA-A-DIA DO NATA http://nataklug.blogspot.com/ Cyber Nett - Internet Banda Larga www.cnett.com.br (42) 3635-2957 Rua Diogo Pinto, 1046, Centro Laranjeiras do Sul - PR Brasil - 85301-290 "... também os sábios possuem coração tangível e podem, por vezes, usar da ciência como meio de demonstrar impressões sentimentais de que muitos não os julgam suscetíveis." Visconde de Taunay

1 0

TPROXY and network layout
by Nataniel Klug 26 Jun '08

26 Jun '08

Hello my friends, I have a new question about TPROXY. I have not put the tproxy+squid cache into work yet becouse I have this question. Lets talk about my layout plan: [router]0<<>>0[linux.qos]1<<>>0[linux.tproxy.cache]1<<>>X[clients] So, about ip and routes: [router]0 IP: 200.xxx.208.1 Netmask: 255.255.255.252 route add -net 200.xxx.208.4/32 gw 200.xxx.208.2 0[linux.qos] IP: 200.xxx.208.2 Netmask: 255.255.255.252 GW: 200.xxx.208.1 [linux.qos]1 IP: 172.16.0.1 Netmask: 255.255.255.252 route add -net 200.xxx.208.4/32 gw 172.16.0.2 0[linux.tproxy.cache] IP: 172.16.0.2 Netmask: 255.255.255.252 GW: 172.16.0.1 [linux.tproxy.cache]1 IP: 200.xxx.208.5 Netmask: 255.255.255.252 X[clients] IP: 200.xxx.208.6 Netmask: 255.255.255.252 GW: 200.xxx.208.5 Using this layout I can provide full access to the client listed. If I use an iptables rule and squid in transparent mode (not tproxy) it is cached normal. My question is: Using tproxy is that necessary that my cache server has an ip that can be reached from the outside world or can it be only made a masquerade into server QOS? -- Att, NATANIEL KLUG nata(a)cnett.com.br LEIA O DIA-A-DIA DO NATA http://nataklug.blogspot.com/ Cyber Nett - Internet Banda Larga www.cnett.com.br (42) 3635-2957 Rua Diogo Pinto, 1046, Centro Laranjeiras do Sul - PR Brasil - 85301-290 "... também os sábios possuem coração tangível e podem, por vezes, usar da ciência como meio de demonstrar impressões sentimentais de que muitos não os julgam suscetíveis." Visconde de Taunay

1 0

question on menuconfig
by Jeffrey 'jf' Lim 25 Jun '08

25 Jun '08

Hi, folks, I've got my kernel source patched and ready to go, and I'm just about to do the configure, but try as I might, I cant seem to locate everything that's mentioned in the README... <quote> then enable tproxy support, `socket' and `TPROXY' modules </quote> Couple of questions: 1. I've think I've found "enable tproxy support", but this is enabled as a module. So is the "enable tproxy support" any different from the "TPROXY module"? 2. where do I go to enable the socket module? Don't see that anywhere. thanks, -jf -- In the meantime, here is your PSA: "It's so hard to write a graphics driver that open-sourcing it would not help." -- Andrew Fear, Software Product Manager, NVIDIA Corporation http://kerneltrap.org/node/7228

2 2

any version number for tproxy?
by Jeffrey 'jf' Lim 25 Jun '08

25 Jun '08

just curious, but is there like some kind of a version number for tproxy? Saw a "tproxy-4.0" directory under "legacy" in downloads ( http://www.balabit.com/downloads/files/tproxy/obsolete/) but no mention of anything on the main page, nor readme, nor the files in the patch (well, not exactly but.. unless it's "1.5.2.5"?) -jf -- In the meantime, here is your PSA: "It's so hard to write a graphics driver that open-sourcing it would not help." -- Andrew Fear, Software Product Manager, NVIDIA Corporation http://kerneltrap.org/node/7228

3 5

iptables make error with cttproxy
by Ritter, Nicholas 24 Jun '08

24 Jun '08

I am attempting to build iptables 1.3.5 (as bundled with centos 5.1 x86_64) with cttproxy 2.6.18-2.0.6. When compiling iptables, I get an error during libipt_TPROXY_sh.o: cc -shared -o extensions/libipt_TPROXY.so extensions/libipt_TPROXY_sh.o extensions/libipt_TPROXY_sh.o: In function '_init': libipt_TPROXY.c: (.text+0x10): multiple definition of '_init' /usr/lib/gcc/x86_64-redhat-linux/4.1.2/../../../../lib64/crti.o:(.init+0 x0): first defined here collect2: ld returned 1 exit status make: *** [extensions/libipt_TPROXY.so] Error 1 What should I do to fix this? (I am the centOS kernel src v2.6.18, squid 2.6stable20) Nick

2 1

Configuring Squid + TPROXY using iptables 1.4
by Nataniel Klug 20 Jun '08

20 Jun '08

People, After a long time waiting to implement this solution I came here to ask how can I configure the redirection from iptables to squid. My squid.conf has this line: /http_port 3128 tproxy/ It starts ok. For a test I have made this "transparent" and make a rule on iptables (iptables -t nat -A PREROUTING -s .... -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128) and it works fine. It is really getting stuff and putting into cache (TCP_HIT). So, my network layout (for testing purpose only) is: /[ internet ] --- [ router ] --- [ cache ] --- [ me ] "me" network: 10.0.0.0/24 (me = .2 and cache = .1) "cache" network: 192.168.1.0/24 (cache = .9 and router = .1)/ This is a fine layout to work as a transparent proxy (using transparent). My router make a route to 10.0.0.0/24 throu cache, like: /route add -net 10.0.0.0/24 gw 192.168.1.9/ And in this router I am masquerading this network. I don't know if in this layout I can make this work so, I have made this script (based on README from tproxy): ------------------------------------------------------------------------ /#!/bin/bash IP="/sbin/ip" IPT="/sbin/iptables" PROXY_PT="3128" PROXY_MK="1" #---- # Criando as regras de redicionamento dos pacotes # marcados pelo iptables #---- $IP rule add fwmark $PROXY_MK lookup 100 $IP route add local 0.0.0.0/0 dev lo table 100 #---- # Criando as regras do iptables #---- $IPT -t mangle -F $IPT -t mangle -N DIVERT $IPT -t mangle -A PREROUTING -p tcp -m socket -j DIVERT $IPT -t mangle -A DIVERT -j MARK --set-mark 1 $IPT -t mangle -A DIVERT -j ACCEPT #---- # Marca os pacotes com destino ao cache #---- $IPT -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port $PROXY_PT/ ------------------------------------------------------------------------ This script is running as the box boots. When I start the cache it works fine but when I try to open a website squid access.log shows this: ------------------------------------------------------------------------ /1213980761.622 0 10.0.0.2 NONE/400 1497 GET /mrtg/trafego.php - NONE/- text/html 1213980783.535 0 10.0.0.2 NONE/400 1465 GET / - NONE/- text/html 1213980783.654 0 10.0.0.2 NONE/400 1487 GET /favicon.ico - NONE/- text/html 1213980794.052 0 10.0.0.2 NONE/400 1465 GET / - NONE/- text/html 1213980794.661 0 10.0.0.2 NONE/400 1465 GET / - NONE/- text/html 1213980795.181 0 10.0.0.2 NONE/400 1465 GET / - NONE/- text/html 1213980906.136 0 10.0.0.2 NONE/400 1465 GET / - NONE/- text/html/ ------------------------------------------------------------------------ And in my browser show that the URL could not be recovered and its URL is invalid. What can I do to solve this problem? -- Att, NATANIEL KLUG nata(a)cnett.com.br LEIA O DIA-A-DIA DO NATA http://nataklug.blogspot.com/ Cyber Nett - Internet Banda Larga www.cnett.com.br (42) 3635-2957 Rua Diogo Pinto, 1046, Centro Laranjeiras do Sul - PR Brasil - 85301-290 "... também os sábios possuem coração tangível e podem, por vezes, usar da ciência como meio de demonstrar impressões sentimentais de que muitos não os julgam suscetíveis." Visconde de Taunay

1 1

tproxy + squid 3 + kernel 2.6.25 + iptables 1.4.0
by Nataniel Klug 20 Jun '08

20 Jun '08

Hello guys, I am having serius problems on putting this system to run. My system is: CentOS v5.1 (like Red Hat Enterprises) Kernel 2.6.25 - compiled with this patches: - http://www.balabit.com/downloads/files/tproxy/tproxy-kernel-2.6.25-20080519… - http://ufpr.dl.sourceforge.net/sourceforge/l7-filter/netfilter-layer7-v2.18… Iptables 1.4.0 - compiled with this patches: - http://ufpr.dl.sourceforge.net/sourceforge/l7-filter/netfilter-layer7-v2.18… - wget http://www.balabit.com/downloads/files/tproxy/tproxy-iptables-1.4.0-2008052… - wget http://www.balabit.com/downloads/files/tproxy/tproxy-iptables-20080204-1915… All tproxy patchs I have get from: http://www.balabit.com/downloads/files/tproxy/ When I tryed to use iptables it works just fine with TPROXY rules. So it is ok to work. Now I want to compile Squid: Squid source: http://www.squid-cache.org/Versions/v3/3.0/squid-3.0.STABLE6.tar.gz I used this command line to configure: ./configure *--enable-linux-tproxy *--with-large-files --with-filedescriptors=16384 --enable-storeio=aufs,coss,diskd,ufs --enable-poll --enable-delay-pools --enable-htcp --enable-carp --with-pthreads --enable-underscores --enable-external --enable-arp-acl During the process it came with this message: checking for linux/netfilter_ipv4.h... yes checking for linux/netfilter_ipv4/ip_tproxy.h... no ... checking if TPROXY header files are installed... no WARNING: Cannot find TPROXY headers, you need to install the tproxy package from: - lynx http://www.balabit.com/downloads/tproxy/ I have come into /usr/src/linux and found a xt_TPROXY.h file under netfilter directory but NO ip_tproxy.h. Here is the problem. After all squid compilation it is installed but when I try to use: http_port 3128 transparent tproxy It returns an error. What can I do to solve this problem? -- Att, NATANIEL KLUG nata(a)cnett.com.br LEIA O DIA-A-DIA DO NATA http://nataklug.blogspot.com/ Cyber Nett - Internet Banda Larga www.cnett.com.br (42) 3635-2957 Rua Diogo Pinto, 1046, Centro Laranjeiras do Sul - PR Brasil - 85301-290 "... também os sábios possuem coração tangível e podem, por vezes, usar da ciência como meio de demonstrar impressões sentimentais de que muitos não os julgam suscetíveis." Visconde de Taunay

5 20

--on-port issues
by Ritter, Nicholas 18 Jun '08

18 Jun '08

I noticed in a search of the list going back that others reported problems with cttproxy, iptables 1.3, and an error from iptables concerning the invalid arguement of '--on-port'. I don't recall finding and resolutions. I apply the cttproxy patch and the patch applies with no problems, builds with no problems, but insmod refuses to load the module, and I suspect that the failure to load the module is why I am getting the --on-port related errors. Any thoughts on how to fix this?

1 0

CentOS 5.1 and Tproxy4
by Mike Adkins 11 Jun '08

11 Jun '08

Hello everyone. Setup: CentOS 5.1 Kernel: Linux centos5.a3rocks.com 2.6.25.5 #1 SMP Sun Jun 8 11:15:19 EDT 2008 i686 athlon i386 GNU/Linux tproxy patch: tproxy-kernel-2.6.25-20080519-165031-1211208631.tar.bz2 iptables: 1.4 iptables patch: tproxy-iptables-1.4.0-20080521-113954-1211362794.patch I think everything went well on the patching of the kernel and patching of iptables. So here is where I am. I am using the latest version of haproxy, which should work. I think the issue that I am having is due to the iptables. I don't think iptables is letting haproxy connect to the secondary host server. So haproxy is listening on port 50080, which is where I have tproxy sitting. Please take a look at my iptables entry and tell me if I am missing anything. I can see that my connection hits the proxy server, but it does not relay to the secondary host. Here is my iptables: echo 1 > /proc/sys/net/ipv4/ip_forward /usr/local/sbin/iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 50080 ip rule add fwmark 1 lookup 100 ip route add local 0.0.0.0/0 dev lo table 100 /usr/local/sbin/iptables -t mangle -N DIVERT /usr/local/sbin/iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT /usr/local/sbin/iptables -t mangle -A DIVERT -j MARK --set-mark 1 /usr/local/sbin/iptables -t mangle -A DIVERT -j ACCEPT The ip for the proxy, where tproxy is sitting is 192.168.0.4 and the host server(running IIS) is 192.1680.06. I would like to use squid, but I am not familiar with it, like I am with haproxy. Any info would be appreciated. I am stuck now. Thanks. Mike

2 1