August 2009 - tproxy - lists.balabit.hu

Re: [tproxy] [PATCH] TProxy: added IPv6 support for socket match
by Balazs Scheidler 31 Aug '09

31 Aug '09

On Sun, 2009-08-30 at 14:26 +0200, Jan Engelhardt wrote: > On Friday 2009-08-28 07:56, Balazs Scheidler wrote: > >+++ b/include/linux/netfilter/xt_socket.h > >@@ -0,0 +1,8 @@ > >+#ifndef _XT_SOCKET_H_match > >+#define _XT_SOCKET_H_match > >+ > >+struct xt_socket_match_info1 { > >+ __u8 transparent:1; > >+}; > >+ > >+#endif /* _XT_SOCKET_H_match */ > > Bitfields are a no-no in the ABI. > Ops, I took that patch from an ancient userspace patch created earlier by Panther. It did work for me, as the kernel uses: enum { XT_SOCKET_TRANSPARENT = 1 << 0, }; struct xt_socket_mtinfo1 { __u8 flags; }; Thanks for noticing. -- Bazsi

1 0

Re: [tproxy] TPROXY 4
by Farhad Ibragimov 31 Aug '09

31 Aug '09

I am having some trouble redirecting port 80 traffic to 3129 using tproxy for transparent proxying. The SYNs come in but there is no SYN-ACK going out. Please help me !!!!! My server have only one single interface with global ip addresses wich connect directly to the internet > Detailed information from my server > ####################################################################### > ############### > Squid Cache: Version 3.1.0.13 > configure options: '--enable-linux-netfilter' '--prefix=/squid/' > --with-squid=/src/squid-3.1.0.13 --enable-ltdl-convenience > [root@proxymain sysconfig]# cat /squid/etc/squid.conf > acl manager proto cache_object > acl localhost src 127.0.0.1/32 > acl to_localhost dst 127.0.0.0/8 > acl test src 85.132.47.0/24 > acl test2 src 85.132.32.0/24 > acl test3 src 62.212.227.0/24 > acl localnet src 10.0.0.0/8 # RFC1918 possible internal network > acl localnet src 172.16.0.0/12 # RFC1918 possible internal network > acl localnet src 192.168.0.0/16 # RFC1918 possible internal network > acl SSL_ports port 443 > acl Safe_ports port 80 # http > acl Safe_ports port 21 # ftp > acl Safe_ports port 443 # https > acl Safe_ports port 70 # gopher > acl Safe_ports port 210 # wais > acl Safe_ports port 1025-65535 # unregistered ports > acl Safe_ports port 280 # http-mgmt > acl Safe_ports port 488 # gss-http > acl Safe_ports port 591 # filemaker > acl Safe_ports port 777 # multiling http > acl Safe_ports port 3129 > acl CONNECT method CONNECT > http_access allow manager localhost > http_access deny manager > http_access deny !Safe_ports > http_access deny CONNECT !SSL_ports > http_access allow localnet > http_access allow localhost > http_access allow test > http_access allow test2 > http_access allow test3 > http_access deny all > http_port 3128 > http_port 3129 tproxy > hierarchy_stoplist cgi-bin ? > coredump_dir /squid/var/cache > refresh_pattern ^ftp: 1440 20% 10080 > refresh_pattern ^gopher: 1440 0% 1440 > refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 > refresh_pattern . 0 20% 4320 > cache_effective_user squid > cache_effective_group squid > visible_hostname proxymain > cache_dir ufs /cache 6000 16 256 > ###################################################################### > [root@proxymain sysconfig]# iptables -V (DOWNLOADED FROM > NETFILTER.ORG-NOT PATCHED) > iptables v1.4.3 > ####################################################################### > root@proxymain sysconfig]# uname -a (DONLOADED FORM KERNEL.ORG - > WITHOWT ANY PATCHES FROM bALABIT) > Linux 2.6.30.5-second #1 SMP Sun Aug 30 22:45:27 AZST 2009 x86_64 x86_64 x86_64 GNU/Linux > ####################################################################### > Chain PREROUTING (policy ACCEPT) > target prot opt source destination > DIVERT tcp -- anywhere anywhere socket > TPROXY tcp -- anywhere anywhere tcp > dpt:80 TPROXY redirect 0.0.0.0:3129 mark 0x1/0x1 > Chain INPUT (policy ACCEPT) > target prot opt source destination > Chain FORWARD (policy ACCEPT) > target prot opt source destination > Chain OUTPUT (policy ACCEPT) > target prot opt source destination > Chain POSTROUTING (policy ACCEPT) > target prot opt source destination > Chain DIVERT (1 references) > target prot opt source destination > MARK all -- anywhere anywhere MARK xset 0x1/0xffffffff > ACCEPT all -- anywhere anywhere > ####################################################################### > [root@proxymain sysconfig]# ip rule ls > 0: from all lookup 255 > 32765: from all fwmark 0x1 lookup 100 > 32766: from all lookup main > 32767: from all lookup default > ##################################################################### > [root@proxymain sysconfig]# ip route ls table 100 > local default dev lo scope host > ##################################################################### > [root@proxymain sysconfig]# lsmod | egrep "xt|nf" > nf_nat 18924 1 iptable_nat > nf_conntrack_ipv4 14448 3 iptable_nat,nf_nat > xt_TPROXY 2616 1 > xt_tcpudp 3544 1 > xt_MARK 3064 1 > xt_socket 2904 1 > nf_tproxy_core 3160 2 xt_TPROXY,xt_socket,[permanent] > nf_conntrack 68208 4 > iptable_nat,nf_nat,nf_conntrack_ipv4,xt_socket > nf_defrag_ipv4 2456 3 nf_conntrack_ipv4,xt_TPROXY,xt_socket > x_tables 22624 6 > iptable_nat,ip_tables,xt_TPROXY,xt_tcpudp,xt_MARK,xt_socket > i2c_nforce2 7768 0 > i2c_core 25568 1 i2c_nforce2 > ext3 123528 2 > jbd 46848 1 ext3 > > ###################################################################### > [root@proxymain sysconfig]# tcpdump -nn -i eth0 port 80 > tcpdump: verbose output suppressed, use -v or -vv for full protocol decode > listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes > 00:12:02.402611 IP 85.132.32.40.1532 > 85.132.32.34.80: S > 3187993921:3187993921(0) win 65535 <mss 1460,nop,nop,sackOK> > 00:12:02.403087 IP 85.132.32.34.80 > 85.132.32.40.1532: S > 3741385741:3741385741(0) ack 3187993922 win 5840 <mss 1460,nop,nop,sackOK> > 00:12:02.402697 IP 85.132.32.40.1532 > 85.132.32.34.80: . ack 1 win 65535 > 00:12:02.407937 IP 85.132.32.40.1532 > 85.132.32.34.80: P 1:413(412) ack 1 win 65535 > 00:12:02.407971 IP 85.132.32.34.80 > 85.132.32.40.1532: . ack 413 win 6432 > 00:12:02.408389 IP 85.132.32.40.42747 > 194.87.0.50.80: S > 3750675832:3750675832(0) win 5840 <mss 1460,sackOK,timestamp 4169685 0,nop,wscale 7> > 00:12:05.407861 IP 85.132.32.40.42747 > 194.87.0.50.80: S > 3750675832:3750675832(0) win 5840 <mss 1460,sackOK,timestamp 4172685 0,nop,wscale 7> > 00:12:11.407465 IP 85.132.32.40.42747 > 194.87.0.50.80: S > 3750675832:3750675832(0) win 5840 <mss 1460,sackOK,timestamp 4178685 0,nop,wscale 7> > 00:12:23.406682 IP 85.132.32.40.42747 > 194.87.0.50.80: S > 3750675832:3750675832(0) win 5840 <mss 1460,sackOK,timestamp 4190685 0,nop,wscale 7> > ####################################################################### > ## > 2009/08/30 23:31:56| Starting Squid Cache version 3.1.0.13 for x86_64-unknown-linux-gnu... > 2009/08/30 23:31:56| Process ID 12787 > 2009/08/30 23:31:56| With 1024 file descriptors available > 2009/08/30 23:31:56| Initializing IP Cache... > 2009/08/30 23:31:56| DNS Socket created at 0.0.0.0, FD 7 > 2009/08/30 23:31:56| Adding domain caspel.com from /etc/resolv.conf > 2009/08/30 23:31:56| Adding nameserver 85.132.32.41 from /etc/resolv.conf > 2009/08/30 23:31:56| Adding nameserver 85.132.32.42 from /etc/resolv.conf > 2009/08/30 23:31:56| Unlinkd pipe opened on FD 12 > 2009/08/30 23:31:56| Store logging disabled > 2009/08/30 23:31:56| Swap maxSize 6144000 + 262144 KB, estimated 492780 objects > 2009/08/30 23:31:56| Target number of buckets: 24639 > 2009/08/30 23:31:56| Using 32768 Store buckets > 2009/08/30 23:31:56| Max Mem size: 262144 KB > 2009/08/30 23:31:56| Max Swap size: 6144000 KB > 2009/08/30 23:31:56| Version 1 of swap file without LFS support detected... > 2009/08/30 23:31:56| Rebuilding storage in /cache (CLEAN) > 2009/08/30 23:31:56| Using Least Load store dir selection > 2009/08/30 23:31:56| Set Current Directory to /squid/var/cache > 2009/08/30 23:31:56| Loaded Icons. > 2009/08/30 23:31:56| Accepting HTTP connections at 0.0.0.0:3128, FD 15. > 2009/08/30 23:31:56| Accepting spoofing HTTP connections at 0.0.0.0:3129, FD 16. > 2009/08/30 23:31:56| HTCP Disabled. > 2009/08/30 23:31:56| Squid modules loaded: 0 > 2009/08/30 23:31:56| Ready to serve requests. > 2009/08/30 23:31:56| Done reading /cache swaplog (0 entries) > 2009/08/30 23:31:56| Finished rebuilding storage from disk. > 2009/08/30 23:31:56| 0 Entries scanned > 2009/08/30 23:31:56| 0 Invalid entries. > 2009/08/30 23:31:56| 0 With invalid flags. > 2009/08/30 23:31:56| 0 Objects loaded. > 2009/08/30 23:31:56| 0 Objects expired. > 2009/08/30 23:31:56| 0 Objects cancelled. > 2009/08/30 23:31:56| 0 Duplicate URLs purged. > 2009/08/30 23:31:56| 0 Swapfile clashes avoided. > 2009/08/30 23:31:56| Took 0.01 seconds ( 0.00 objects/sec). > 2009/08/30 23:31:56| Beginning Validation Procedure > 2009/08/30 23:31:56| Completed Validation Procedure > 2009/08/30 23:31:56| Validated 25 Entries > 2009/08/30 23:31:56| store_swap_size = 0 > 2009/08/30 23:31:57| storeLateRelease: released 0 objects > [root@proxymain sysconfig]# > 1251655621.226 155982 85.132.32.40 TCP_MISS/503 4143 GET > http://www.squid-cache.org/Artwork/SN.png - > DIRECT/www.squid-cache.org text/html > 1251655621.226 107693 85.132.47.219 TCP_MISS/503 4151 GET > http://www.squid-cache.org/Artwork/SN.png - > DIRECT/www.squid-cache.org text/html > 1251655621.230 0 85.132.32.40 TCP_MISS/503 4143 GET > http://www.squid-cache.org/Artwork/SN.png - > DIRECT/www.squid-cache.org text/html > 1251655646.107 6457 85.132.47.219 TCP_MISS/000 0 GET > http://www.google.az/ - DIRECT/www.google.az - > 1251655658.226 60014 85.132.47.219 TCP_MISS/504 4510 POST > http://safebrowsing.clients.google.com/safebrowsing/downloads? - > DIRECT/safebrowsing.clients.google.com text/html > 1251656346.912 21227 85.132.32.40 TCP_MISS/000 0 GET > http://194.87.0.50/ - DIRECT/194.87.0.50 - > 1251656526.724 179798 85.132.32.40 TCP_MISS/504 3977 GET > http://www.ru/ - DIRECT/194.87.0.50 text/html > 1251656586.724 59968 85.132.32.40 TCP_MISS/504 4069 GET > http://www.squid-cache.org/Artwork/SN.png - DIRECT/12.160.37.9 text/html > 1251656867.544 88637 85.132.32.40 TCP_MISS/000 0 GET http://www.ru/ - DIRECT/www.ru - > 1251657043.812 176266 85.132.32.40 TCP_MISS/000 0 GET http://www.ru/ - DIRECT/www.ru - > 1251657101.539 60109 85.132.32.40 TCP_MISS/504 4018 GET > http://www.ru/ - DIRECT/194.87.0.50 text/html > 1251657207.136 64675 85.132.32.40 TCP_MISS/000 0 GET http://www.ru/ - DIRECT/www.ru - > 1251657387.522 180384 85.132.32.40 TCP_MISS/504 4018 GET > http://www.ru/ - DIRECT/194.87.0.50 text/html > 1251657567.525 179983 85.132.32.40 TCP_MISS/504 4069 GET > http://www.squid-cache.org/Artwork/SN.png - DIRECT/12.160.37.9 text/html > 1251657569.936 9407 85.132.47.219 TCP_MISS/000 0 GET > http://85.132.32.34/ - DIRECT/85.132.32.34 - > 1251657725.527 180669 85.132.32.40 TCP_MISS/504 4018 GET > http://www.ru/ - DIRECT/194.87.0.50 text/html > 1251657905.534 179988 85.132.32.40 TCP_MISS/504 4069 GET > http://www.squid-cache.org/Artwork/SN.png - DIRECT/12.160.37.9 text/html > 1251658194.669 112560 85.132.32.40 TCP_MISS/000 0 GET http://www.ru/ - DIRECT/www.ru - > 1251658283.066 88394 85.132.32.40 TCP_MISS/000 0 GET http://www.ru/ - DIRECT/www.ru - > 1251658463.543 180476 85.132.32.40 TCP_MISS/504 4018 GET > http://www.ru/ - DIRECT/194.87.0.50 text/html > 1251658643.547 179986 85.132.32.40 TCP_MISS/504 4069 GET > http://www.squid-cache.org/Artwork/SN.png - DIRECT/12.160.37.9 text/html > 1251659072.554 60493 85.132.32.40 TCP_MISS/504 4473 POST > http://safebrowsing.clients.google.com/safebrowsing/downloads? - DIRECT/74.125.87.100 text/html > 1251659703.563 181155 85.132.32.40 TCP_MISS/504 4018 GET > http://www.ru/ - DIRECT/194.87.0.50 text/html -- Best regards, Farhad mailto:inara.ibragimova@gmail.com

1 0

Re: [tproxy] [PATCH 03/11] TProxy: reuse a 32bit hole in struct ipv6_pinfo
by Balazs Scheidler 30 Aug '09

30 Aug '09

On Sat, 2009-08-29 at 18:46 +0200, Jan Engelhardt wrote: > On Sunday 2009-08-23 11:02, Balazs Scheidler wrote: > > >While looking for a place to add a new bitfield in ipv6_pinfo, > >I've found a 32 bit hole (in 64 bit mode) at the beginning of the struct. > >Since dst_cookie is used in the output fastpath, I've moved this field to > >fill the hole, thus decreasing the struct size on 64 bit platforms by > >4 bytes. > > Hm? I do not see a size reduction. pahole(1) tells me [for a base of > v2.6.31-rc1-103-g644fc2c] the size is the same before and after. you are right. I was inserting another bitfield and with that the size didn't grow. at the end the bitfield wasn't needed, but I still felt that dst_cookie should be moved to the first cacheline. it is used in the output fastpath. However since that's not necessarily worth in itself I can completely drop this patch. An updated version follows. By the way, what should be the proper procedure for posting patches that are tproxy specific but touch the core networking code? Should those go through Patrick, or should I just post them to netdev? Or just cross-post the patch series to both lists? commit 5ddc846b926be02c6cab93406d6e8adb1e3c9124 Author: Balazs Scheidler <bazsi(a)balabit.hu> Date: Sun Aug 30 08:52:01 2009 +0200 TProxy: move dst_cookie to the first cacheline in ipv6_pinfo While looking for a place to add a new bitfield in ipv6_pinfo, I've found a 32 bit hole (in 64 bit mode) at the beginning of the struct. Since dst_cookie is used in the output fastpath, I've moved this field to fill the hole. The original place of dst_cookie is now empty, but can become a place to add further fields to the struct. Signed-off-by: Balazs Scheidler <bazsi(a)balabit.hu> diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h index c662efa..be4c9c6 100644 --- a/include/linux/ipv6.h +++ b/include/linux/ipv6.h @@ -285,6 +285,7 @@ struct ipv6_pinfo { struct in6_addr saddr; struct in6_addr rcv_saddr; struct in6_addr daddr; + __u32 dst_cookie; struct in6_pktinfo sticky_pktinfo; struct in6_addr *daddr_cache; #ifdef CONFIG_IPV6_SUBTREES @@ -348,7 +349,7 @@ struct ipv6_pinfo { */ __u8 tclass; - __u32 dst_cookie; + /* 32 bits hole on 64 bit platforms */ struct ipv6_mc_socklist *ipv6_mc_list; struct ipv6_ac_socklist *ipv6_ac_list; > > > --- p.1 2009-08-29 18:45:37.996787299 +0200 > +++ p.2 2009-08-29 18:43:08.152753849 +0200 > @@ -21824,10 +21824,8 @@ struct ipv6_pinfo { > struct in6_addr saddr; /* 0 16 */ > struct in6_addr rcv_saddr; /* 16 16 */ > struct in6_addr daddr; /* 32 16 */ > - struct in6_pktinfo sticky_pktinfo; /* 48 20 */ > - > - /* XXX 4 bytes hole, try to pack */ > - > + __u32 dst_cookie; /* 48 4 */ > + struct in6_pktinfo sticky_pktinfo; /* 52 20 */ > /* --- cacheline 1 boundary (64 bytes) was 8 bytes ago --- */ > struct in6_addr * daddr_cache; /* 72 8 */ > struct in6_addr * saddr_cache; /* 80 8 */ > @@ -21862,7 +21860,9 @@ struct ipv6_pinfo { > __u8 ipv6only:1; /* 106: 3 1 */ > __u8 srcprefs:3; /* 106: 0 1 */ > __u8 tclass; /* 107 1 */ > - __u32 dst_cookie; /* 108 4 */ > + > + /* XXX 4 bytes hole, try to pack */ > + > struct ipv6_mc_socklist * ipv6_mc_list; /* 112 8 */ > struct ipv6_ac_socklist * ipv6_ac_list; /* 120 8 */ > /* --- cacheline 2 boundary (128 bytes) --- */ > -- Bazsi

1 0

[PATCH] userspace support for IPv6 TProxy
by Balazs Scheidler 28 Aug '09

28 Aug '09

This patchset implements support for the IPv6 TProxy functionality. It also includes the still missing option to the socket match (--transparent) which is already present in the kernel but not in the userspace sources. Balazs Scheidler (2): TProxy: added IPv6 support for socket match TProxy: added IPv6 support to the TPROXY target extensions/libxt_TPROXY.c | 213 +++++++++++++++++++++++++++++------ extensions/libxt_socket.c | 103 ++++++++++++++++-- extensions/libxt_socket.man | 6 +- include/linux/netfilter/xt_TPROXY.h | 15 ++- include/linux/netfilter/xt_socket.h | 8 ++ 5 files changed, 295 insertions(+), 50 deletions(-) create mode 100644 include/linux/netfilter/xt_socket.h

1 2

[PATCH 00/11] TProxy for IPv6
by Balazs Scheidler 24 Aug '09

24 Aug '09

I've just pushed a set of patches that implement TProxy for IPv6 to http://git.balabit.hu/bazsi/tproxy-2.6.git The patches are also posted in reply to this mail. Although some work is still needed, basic testing shows that it works all right. The accompanying iptables patches are available at http://git.balabit.hu/bazsi/iptables-tproxy.git There are some things left to do: * the recognition of related ICMPv6 packets missing (from xt_socket.c) * I should probably split xt_TPROXY/xt_socket to IPv4 and IPv6 modules, as right now those depend on both stacks at the same time. I'm on a holiday right now, thus I might not respond to comments in a timely manner, however I'm interested in any comments/feedback nevertheless. Harry, I didn't remember that you actually wanted to work on TProxy for IPv6, I just vaguely remembered that there was someone asking for IPv6 support, thus I implemented this without being in the know. If you started hacking, I hope that we didn't completely duplicate effort. I'd appreciate help in the missing bits and/or testing whichever fits you best. Also, I have written a Python test script to test TProxy functionality automatically both for IPv4 and IPv6, I can post that as well if anyone is interested. Balazs Scheidler (11): TProxy: kick out TIME_WAIT sockets in case a new connection comes in with the same tuple TProxy: add lookup type checks for UDP in nf_tproxy_get_sock_v4() TProxy: reuse a 32bit hole in struct ipv6_pinfo TProxy: split off ipv6 defragmentation to a separate module TProxy: added const specifiers to udp lookup functions TProxy: added udp6_lib_lookup function TProxy: implement IPv6 "local" routing type TProxy: allow non-local binds of IPv6 sockets if IP_TRANSPARENT is enabled TProxy: added IPv6 socket lookup function to nf_tproxy_core TProxy: added IPv6 support to the TPROXY target TProxy: added IPv6 support to the socket match include/linux/ipv6.h | 3 +- include/linux/netfilter/xt_TPROXY.h | 15 +- include/net/netfilter/ipv6/nf_defrag_ipv6.h | 6 + include/net/netfilter/nf_tproxy_core.h | 192 +++++++++++++++++++- include/net/udp.h | 3 + net/ipv6/af_inet6.c | 2 +- net/ipv6/netfilter/Makefile | 5 +- net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c | 58 +------ net/ipv6/netfilter/nf_conntrack_reasm.c | 12 +- net/ipv6/netfilter/nf_defrag_ipv6_hooks.c | 109 +++++++++++ net/ipv6/route.c | 6 +- net/ipv6/udp.c | 16 ++- net/netfilter/nf_tproxy_core.c | 35 ---- net/netfilter/xt_TPROXY.c | 239 +++++++++++++++++++++--- net/netfilter/xt_socket.c | 113 +++++++++++- 15 files changed, 675 insertions(+), 139 deletions(-) create mode 100644 include/net/netfilter/ipv6/nf_defrag_ipv6.h create mode 100644 net/ipv6/netfilter/nf_defrag_ipv6_hooks.c

1 11

tproxy patches for kernel 2.6.27
by Dejan Paradiž 24 Aug '09

24 Aug '09

Does anyone now where i can find tproxy patches for kernel 2.6.27 and patches for iptables 1.4.0 or higher.

2 1

help with tproxy.
by Marco Clocchiatti 19 Aug '09

19 Aug '09

I want to setup tproxy in my local net. I studied your howto: http://wiki.squid-cache.org/Features/Tproxy4 but I don't understand how to adapt it to my setup. I'm using squid-3.1.0.13_beta iptables-1.4.3.2 and kernel 2.6.30 from a gentoo distribution. I have a linear net topology: internet <----> 192.168.1.1 adsl router <----> 192.168.1.12 proxy server 192.168.0.12 <----> 192.168.0.13 local_client this is the routing table for the client: local_client ~ # route -en Kernel IP routing table Destination Gateway Genmask Flags MSS Window irtt Iface 192.168.0.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 127.0.0.0 127.0.0.1 255.0.0.0 UG 0 0 0 lo 0.0.0.0 192.168.0.12 0.0.0.0 UG 0 0 0 eth0 and this one for the proxy server: proxy_server ~ # ip route list table all local default dev lo table 100 scope host 192.168.1.0/24 dev eth1 proto kernel scope link src 192.168.1.12 192.168.0.0/24 dev eth0 proto kernel scope link src 192.168.0.12 127.0.0.0/8 via 127.0.0.1 dev lo default via 192.168.1.1 dev eth1 broadcast 192.168.0.255 dev eth0 table local proto kernel scope link src 192.168.0.12 broadcast 192.168.1.0 dev eth1 table local proto kernel scope link src 192.168.1.12 broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1 local 192.168.0.12 dev eth0 table local proto kernel scope host src 192.168.0.12 broadcast 192.168.0.0 dev eth0 table local proto kernel scope link src 192.168.0.12 broadcast 192.168.1.255 dev eth1 table local proto kernel scope link src 192.168.1.12 local 192.168.1.12 dev eth1 table local proto kernel scope host src 192.168.1.12 broadcast 127.0.0.0 dev lo table local proto kernel scope link src 127.0.0.1 local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1 local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1 proxy_server ~ # ip rule 0: from all lookup local 32765: from all fwmark 0x1 lookup 100 32766: from all lookup main 32767: from all lookup default this is my squid configuration: proxy_server ~ # grep -v ^# /etc/squid/squid.conf|grep -v ^$ acl manager proto cache_object acl localhost src 127.0.0.1/32 acl to_localhost dst 127.0.0.0/8 acl localnet src 10.0.0.0/8 # RFC1918 possible internal network acl localnet src 172.16.0.0/12 # RFC1918 possible internal network acl localnet src 192.168.0.0/16 # RFC1918 possible internal network acl SSL_ports port 443 acl Safe_ports port 80 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 # https acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl Safe_ports port 901 # SWAT acl purge method PURGE acl CONNECT method CONNECT http_access allow manager localhost http_access deny manager http_access allow purge localhost http_access deny purge http_access deny !Safe_ports http_access deny CONNECT !SSL_ports http_access allow localnet http_access allow localhost http_access allow localhost http_access deny all http_port 3128 http_port 3129 tproxy hierarchy_stoplist cgi-bin ? cache_dir diskd /var/cache/squid 50M 16 256 coredump_dir /var/cache/squid refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 refresh_pattern . 0 20% 4320 shutdown_lifetime 2 seconds visible_hostname proxy_server this is my iptables conf: proxy_server ~ # iptables -t mangle -L -n Chain PREROUTING (policy ACCEPT) target prot opt source destination DIVERT tcp -- 0.0.0.0/0 0.0.0.0/0 socket TPROXY tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 TPROXY redirect 192.168.1.12:3129 mark 0x1/0x1 Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain POSTROUTING (policy ACCEPT) target prot opt source destination Chain DIVERT (1 references) target prot opt source destination MARK all -- 0.0.0.0/0 0.0.0.0/0 MARK xset 0x1/0xffffffff ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 the following are commands to build this conf: iptables -t mangle -N DIVERT iptables -t mangle -A DIVERT -j MARK --set-mark 1 iptables -t mangle -A DIVERT -j ACCEPT iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 3129 --on-ip 192.168.1.12 ip rule add fwmark 1 lookup 100 ip route add local 0.0.0.0/0 dev lo table 100 echo 1 > /proc/sys/net/ipv4/ip_forward but all this does not works. the client does not ping out of 192.168.0.* : local_client ~ # ping 192.168.1.1 PING 192.168.1.1 (192.168.1.1) 56(84) bytes of data. ^C --- 192.168.1.1 ping statistics --- 87 packets transmitted, 0 received, 100% packet loss, time 85999ms squid works, but only for internet bots which are looking my home apache server: proxy_server ~ # tail -n 89 /var/log/squid/access.log -n1 1250664301.462 0 66.249.67.133 TCP_DENIED/403 3771 GET http://cloc3.dyndns.org/index.html/doku.php/22_dicembre_2008/problema4? - NONE/- text/html That's stupid: I want squid for the local users, not for remote hosts. Where I'm falling?

1 0

Re: [tproxy] Problems Caching
by Jose Oliveira de Almeida Filho 14 Aug '09

14 Aug '09

*squid.conf: *acl manager proto cache_object acl localhost src 127.0.0.1/32 acl to_localhost dst 127.0.0.0/8 acl localnet src 10.0.0.0/8 # RFC1918 possible internal network acl SSL_ports port 443 acl Safe_ports port 80 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 # https acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl CONNECT method CONNECT http_access allow manager localhost http_access deny manager http_access deny !Safe_ports http_access deny CONNECT !SSL_ports http_access allow localnet http_access allow localhost http_access deny all icp_access deny all htcp_access deny all http_port 3128 http_port 3129 tproxy hierarchy_stoplist cgi-bin ? cache_mem 100 MB cache_dir ufs /var/spool/squid 100 16 256 access_log /var/log/access.log squid cache_log /var/log/cache.log refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern (cgi-bin|\?) 0 0% 0 refresh_pattern . 0 20% 4320 icp_port 3130 coredump_dir /var/spool/squid *iptables configuration:* iptables -t mangle -N DIVERT iptables -t mangle -A DIVERT -j MARK --set-mark 1 iptables -t mangle -A DIVERT -j DROP iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 3129 ip rule add fwmark 1 lookup 100 ip route add local 0.0.0.0/0 dev lo table 100 *squid -v:* Squid Cache: Version 3.1.0.13 configure options: '--prefix=/usr' '--localstatedir=/var' '--libexecdir=/usr/lib/squid' '--srcdir=.' '--datadir=/usr/share/squid' '--sysconfdir=/etc/squid' '--with-default-user=proxy' '--with-logdir=/var/log' '--with-pidfile=/var/run/squid.pid' '--enable-linux-netfilter' --with-squid=/usr/src/squid-3.1.0.13 --enable-ltdl-convenience *network cenario:* pc => proxy/squid/tproxy => router *José Oliveira de Almeida Filho* Analista de Redes SERPRO/SUPRE/REPRO/RERCE *(** *+55 0XX 81 2126 4016 *** _jose.almeida-filho(a)serpro.gov.br_ Asif Bakali escreveu: > Gday > post your squid conf , iptables configuraion , squid -v compile > options and network senario > > > > On Fri, Aug 14, 2009 at 12:40 AM, Jose Oliveira de Almeida Filho > <jose.almeida-filho(a)serpro.gov.br > <mailto:jose.almeida-filho@serpro.gov.br>> wrote: > > Hi, > > I'm problems for caching squid. > > My situation is: > > The squid isn't writing in access.log, but the traffic is arriving > to destination with origin ip. > The squid isn't doing caching too. > > The cards are in mode bridge e the permissons are for user proxy > normally (+w). > When stop squid, the traffic stop too, indicanting that the > iptables transfer packets to squid (http_port 3129 tproxy) > > Att., > > -- > *José Oliveira de Almeida Filho* > Analista de Redes > SERPRO/SUPRE/REPRO/RERCE > *(** *+55 0XX 81 2126 4016 > *** _jose.almeida-filho(a)serpro.gov.br > <mailto:jose.almeida-filho@serpro.gov.br>_ > > "Esta mensagem do SERVIÇO FEDERAL DE PROCESSAMENTO DE DADOS (SERPRO), empresa pública federal regida pelo disposto na Lei Federal nº 5.615, é enviada exclusivamente a seu destinatário e pode conter informações confidenciais, protegidas por sigilo profissional. Sua utilização desautorizada é ilegal e sujeita o infrator às penas da lei. Se você a recebeu indevidamente, queira, por gentileza, reenviá-la ao emitente, esclarecendo o equívoco." > > "This message from SERVIÇO FEDERAL DE PROCESSAMENTO DE DADOS (SERPRO) -- a government company established under Brazilian law (5.615/70) -- is directed exclusively to its addressee and may contain confidential data, protected under professional secrecy rules. Its unauthorized use is illegal and may subject the transgressor to the law's penalties. If you're not the addressee, please send it back, elucidating the failure." > > > _______________________________________________ > tproxy mailing list > tproxy(a)lists.balabit.hu <mailto:tproxy@lists.balabit.hu> > https://lists.balabit.hu/mailman/listinfo/tproxy > > "Esta mensagem do SERVIÇO FEDERAL DE PROCESSAMENTO DE DADOS (SERPRO), empresa pública federal regida pelo disposto na Lei Federal nº 5.615, é enviada exclusivamente a seu destinatário e pode conter informações confidenciais, protegidas por sigilo profissional. Sua utilização desautorizada é ilegal e sujeita o infrator às penas da lei. Se você a recebeu indevidamente, queira, por gentileza, reenviá-la ao emitente, esclarecendo o equívoco." "This message from SERVIÇO FEDERAL DE PROCESSAMENTO DE DADOS (SERPRO) -- a government company established under Brazilian law (5.615/70) -- is directed exclusively to its addressee and may contain confidential data, protected under professional secrecy rules. Its unauthorized use is illegal and may subject the transgressor to the law's penalties. If you're not the addressee, please send it back, elucidating the failure."

1 0

Problems Caching
by Jose Oliveira de Almeida Filho 13 Aug '09

13 Aug '09

Hi, I'm problems for caching squid. My situation is: The squid isn't writing in access.log, but the traffic is arriving to destination with origin ip. The squid isn't doing caching too. The cards are in mode bridge e the permissons are for user proxy normally (+w). When stop squid, the traffic stop too, indicanting that the iptables transfer packets to squid (http_port 3129 tproxy) Att., -- *José Oliveira de Almeida Filho* Analista de Redes SERPRO/SUPRE/REPRO/RERCE *(** *+55 0XX 81 2126 4016 *** _jose.almeida-filho(a)serpro.gov.br_ "Esta mensagem do SERVIÇO FEDERAL DE PROCESSAMENTO DE DADOS (SERPRO), empresa pública federal regida pelo disposto na Lei Federal nº 5.615, é enviada exclusivamente a seu destinatário e pode conter informações confidenciais, protegidas por sigilo profissional. Sua utilização desautorizada é ilegal e sujeita o infrator às penas da lei. Se você a recebeu indevidamente, queira, por gentileza, reenviá-la ao emitente, esclarecendo o equívoco." "This message from SERVIÇO FEDERAL DE PROCESSAMENTO DE DADOS (SERPRO) -- a government company established under Brazilian law (5.615/70) -- is directed exclusively to its addressee and may contain confidential data, protected under professional secrecy rules. Its unauthorized use is illegal and may subject the transgressor to the law's penalties. If you're not the addressee, please send it back, elucidating the failure."

2 1

Problem with TPROXY and RAPIDSHARE
by Carlos Botejara 05 Aug '09

05 Aug '09

hi I have a problem, but first I describe the scenario I have clients with public IP Mikrotik router redirecting traffic to SQUID Squid 3.1 with support for TPROXY Iptables 1.4.4 with support for TPROXY Debian Lenny / Kernel 2.6.28 with support for TPROXY well. The proxy works as well, and when I made some test pages whatismyip, shows that the ip is the CLIENT. However. I can not get my clients with public IP address simultaneously downloading from RapidShare / Megaupload ETC. The error shown within these pages is the typical already are downloading from that ip, so if viewing RapidShare IP SQUID in reality and not the client. How fix this? the configuration file of squid in the harbor is well http_port 81 tproxy Iptables: iptables -t mangle -N DIVERT iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT iptables -t mangle -A DIVERT -j MARK --set-mark 1 iptables -t mangle -A DIVERT -j ACCEPT iptables -t mangle -A PREROUTING -p tcp --dport 3128 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 81 ip rule add fwmark 1 lookup 100 ip route add local 0.0.0.0/0 dev lo table 100 echo 1 > /proc/sys/net/ipv4/ip_forward Mikrotik: Have a rule in the firewall to redirect all traffic to port 80 of the SQUID to the IP, port 3128 All clients create sessions PPPOE in Router Mikrotik May help?

2 1