July 2008 - tproxy - lists.balabit.hu

tproxy support for iptables > 1.4.0
by Ritter, Nicholas 25 Sep '08

25 Sep '08

Is there tproxy patch support for iptables 1.4.1 and/or 1.4.1.1? I just tried to patch against both and got errors when using the tproxy-iptables-1.4.0-20080521-113954-1211362794.patch <http://www.balabit.com/downloads/files/tproxy/tproxy-iptables-1.4.0-200 80521-113954-1211362794.patch> patch file.

3 3

Squid Source Port for Outbound
by Ted Kaczmarek 30 Jul '08

30 Jul '08

Will Tproxy reuse the same source port for outbound requests on the clients behalf or will it genertate a new source port? I am thinking for transpareny the source port should be the same, but I would like to verify that. Regards. Ted

1 0

Making a PEP with tproxy and haproxy
by Diego M. Vadell 28 Jul '08

28 Jul '08

Hi, We have a satellite link between an ethernet networks full of windows PCs and the internet. Windows PCs don't have it's TCP stack optimized for a satellite link (i.e. 700ms delay, 3Mbps) so they barely use it (they wait for acks and use a little sliding-window, so the rtt kills the throughput). Our ISP uses something called a PEP,: a tcp proxy that answers all the LAN's tcp connections. This PEP is well optimized, so it can fully use the satellite link and feed the ethernet PCs at full speed. This page: http://www.sonet.at/dsdsl-vpn/dsdsl-vpn.htm explains the problem with more detail. Everything works OK except when we put a VPN to connect this place with another office. The PEP is on the ISP's side, so it sees IPSEC traffic. So I want to make a PEP (or say, a proxy that can transparently proxy any tcp connection) in the inside. From reading I think it can be done: haproxy has tproxy support, so I could tproxy everything to haproxy, and tune the TCP stack of the proxy for the satellite link. But as I have never done it, I thought I may ask: Am I missing something horribly big here? Thanks in advance, -- Diego.

2 2

BRIDGE + IMQ + TPROXY
by HADI UTOMO 26 Jul '08

26 Jul '08

hello.. i'm new on linux, can some one help me whit my case.. i'm planning to make a bridge whit imq ( htb/ cbq bandwidth shapper running ) + tproxy running on the bridge. all connection from local network to the internet must be shapped and get proxyed by tproxy at the bridge before reach the adsl modem. now i'm allready compiled the kernel + iptables + squid 2.6 whit imq & tproxy patch and run well when i test the iptables whit tproxy sample script, now my problem is how look like is the syntax for iptables so my box can running as bridge,shapper and proxy ? here is my bridge setting : -------------------- # bridge.sh ifconfig eth0 down ifconfig eth1 down ifconfig eth0 0.0.0.0 up ifconfig eth1 0.0.0.0 up brctl addbr br0 brctl addif br0 eth0 brctl addif br0 eth1 ifconfig br0 192.168.1.253 up route add default gw 192.168.1.254 brctl stp off btctl setfd br0 off --------------------

1 0

Squid 3 head errors with interception
by Ritter, Nicholas 25 Jul '08

25 Jul '08

I have been talking with developers on the squid-dev list about issues with havign both tproxy and interception enbaled on the same listen port when using WCCP, Squid 3.1 (squid 3 HEAD), and TProxy 4.1.0. The discussion revolves around the following errors in cache.log: 2008/07/25 12:38:57| IPInterception.cc(171) NetfilterTransparent: NF getsockopt(IP_TRANSPARENT) failed: (92) Protocol not available 2008/07/25 12:47:12| IPInterception.cc(137) NetfilterInterception: NF getsockopt(SO_ORIGINAL_DST) failed: (11) Resource temporarily unavailable And occasional (99) errors seen by the client. It had been mentioned that interception and tproxy options should not be used together in a WCCP setup, but there is confusion as to how to seperate them, mush less if it is really required. Anyone have comments on this? Nick

1 0

Merging tproxy patch to standard kernel ?
by Yoshioka Tsuneo 23 Jul '08

23 Jul '08

Hello It is often required to keeping source address on proxy, and tproxy seems be almost only one solution. Now, it seems be very nice if tproxy patch is merged to standard kernel. Is there any plan to merge tproxy to standard kernel ? Thank you ! -- Nihon F-Secure Corporation Yoshioka Tsuneo E-MAIL: Tsuneo.Yoshioka(a)f-secure.com

3 5

tproxy related error in squid?
by Ritter, Nicholas 22 Jul '08

22 Jul '08

I see an error in my squid cache.log that I think is TProxy related, and wanted to post it here to see if anyone had input before posting it to the squid list. The versions of everything I am using is listed below, followed by the error. Software versions: squid-3.HEAD-20080721 iptables 1.4.0 kernel 2.6.25.11 This is part of a WCCP setup with a Cisco router. My iptables setup is: Table: filter Chain INPUT (policy ACCEPT) num target prot opt source destination 1 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 2 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 3 ACCEPT 47 -- 0.0.0.0/0 0.0.0.0/0 4 ACCEPT 47 -- 0.0.0.0/0 0.0.0.0/0 5 LocalFW all -- 0.0.0.0/0 0.0.0.0/0 Chain FORWARD (policy ACCEPT) num target prot opt source destination 1 LocalFW all -- 0.0.0.0/0 0.0.0.0/0 Chain OUTPUT (policy ACCEPT) num target prot opt source destination Chain LocalFW (2 references) num target prot opt source destination 1 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 2 ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 255 3 ACCEPT udp -- 10.48.33.2 0.0.0.0/0 udp dpt:2048 4 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 5 ACCEPT tcp -- 10.9.7.206 0.0.0.0/0 tcp dpt:22 state NEW 6 ACCEPT tcp -- 10.2.5.100 0.0.0.0/0 tcp dpt:22 state NEW 7 ACCEPT tcp -- 10.9.7.206 0.0.0.0/0 tcp dpt:10000 state NEW 8 ACCEPT udp -- 10.2.5.100 0.0.0.0/0 udp spt:161 9 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:8080 10 ACCEPT tcp -- 10.9.7.206 0.0.0.0/0 tcp dpt:10000 11 REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited Table: mangle Chain PREROUTING (policy ACCEPT) num target prot opt source destination 1 DIVERT tcp -- 0.0.0.0/0 0.0.0.0/0 socket 2 TPROXY tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 TPROXY redirect 0.0.0.0:3128 mark 0x1/0x1 Chain INPUT (policy ACCEPT) num target prot opt source destination Chain FORWARD (policy ACCEPT) num target prot opt source destination Chain OUTPUT (policy ACCEPT) num target prot opt source destination Chain POSTROUTING (policy ACCEPT) num target prot opt source destination Chain DIVERT (1 references) num target prot opt source destination 1 MARK all -- 0.0.0.0/0 0.0.0.0/0 MARK set 0x1 2 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 The squid clients are in the 10.48.1.0/24 subnet, the router is in both the 10.48.1.0/24 and the 10.48.33.0/24 subnet. The squid box is 10.48.33.2, the router is 10.48.33.1. Both IP subnets are seperate layer 2 vlans. In the errors below, 10.48.1.200 is my client test machine. Error with "echo 0 > /proc/sys/net/ipv4/ip_nonlocal_bind": 2008/07/22 12:57:05| IPInterception.cc(137) NetfilterInterception: NF getsockopt(SO_ORIGINAL_DST) failed: (11) Resource temporarily unavailable 2008/07/22 12:57:05| IPInterception.cc(171) NetfilterTransparent: NF getsockopt(IP_TRANSPARENT) failed: (92) Protocol not available Error with "echo 1 > /proc/sys/net/ipv4/ip_nonlocal_bind": 2008/07/22 13:01:50| IPInterception.cc(137) NetfilterInterception: NF getsockopt(SO_ORIGINAL_DST) failed: (11) Resource temporarily unavailable 2008/07/22 13:01:50| IPInterception.cc(171) NetfilterTransparent: NF getsockopt(IP_TRANSPARENT) failed: (92) Protocol not available 2008/07/22 13:01:54| commBind: Cannot bind socket FD 30 to 10.48.1.200:5675: (98) Address already in use 2008/07/22 13:01:54| comm.cc(997) commResetFD: bind: (98) Address already in use

1 1

tproxy 4.1 NAT question
by Ritter, Nicholas 22 Jul '08

22 Jul '08

Am I assuming correctly that the the iptables nat rule IS needed as show in the beginning of item 1 unter "How to start using it?" in the readme or is that simple a reference of how it was done before? To clarify, does the iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --on-port <proxyport> \ --tproxy-mark 0x1/0x1 replace the iptables -t nat -A PREROUTING -j DNAT --to-dest <localip> --to-port <proxyport> Thanks, Nick

1 0

difference between two patches
by Ritter, Nicholas 22 Jul '08

22 Jul '08

Is the difference between tproxy-iptables-20080204-1915.patch <http://www.balabit.com/downloads/files/tproxy/tproxy-iptables-20080204- 1915.patch> and tproxy-iptables-1.4.0-20080521-113954-1211362794.patch <http://www.balabit.com/downloads/files/tproxy/tproxy-iptables-1.4.0-200 80521-113954-1211362794.patch> the version of iptables that it patches? ( example: tproxy-iptables-1.4.0-20080521-113954-1211362794.patch <http://www.balabit.com/downloads/files/tproxy/tproxy-iptables-1.4.0-200 80521-113954-1211362794.patch> is only for 1.4 and tproxy-iptables-20080204-1915.patch <http://www.balabit.com/downloads/files/tproxy/tproxy-iptables-20080204- 1915.patch> in for pre-1.4) Nick

2 1

cttproxy question
by Ritter, Nicholas 21 Jul '08

21 Jul '08

I have two quick question about the old cttproxy patches: 1) is "echo 1 > /proc/sys/net/ipv4/ip_nonlocal_bind" needed? 2) is only one iptables rule needed? I am using : "iptables -t tproxy -A PREROUTING -s 10.48.1.0/16 -p tcp -m tcp --dport 80 -j TPROXY --on-port 80 --on-ip 0.0.0.0" and it is not working. I still see the ip of the squid box, and not the original client. It seems as though the problem is in iptables somewhere. I am using this as part of a L3/L4 WCCP/Squid setup and not a bridging solution. I have looked at multiple tproxy howtos...only one worked, and it was a bridging solution on Debian. But I am not using Debian, and I can't use a bridging solution.

1 0