Gday
Hello one of my server FC11 x64 bit running Tproxy with combination of
iptables + ebtables rules during peek hours machine was rash with given such
as error "kernel panic " . when i replace tproxy with netfilter and remove
ebtables rules just use simple iptables with NAT rules everything was fine.
anyone faced this issue before ? find below my configuration
Kernel =2.6.29.6-217.2.8.fc11.x86_64
O/S= FC 11 x64 Intel based
iptables= v1.4.3.1
ebtables= v2.0.9-1
firewall.conf
#!/bin/sh
IPTABLES=/sbin/iptables
EBTABLES=/sbin/ebtables
EXTDEV="eth0"
INTDEV="eth1"
SERVERIP="xxx.xxx.xxx.15"
${EBTABLES} -t broute -F
${EBTABLES} -t broute -A BROUTING -i $EXTDEV -p ipv4 --ip-protocol tcp
--ip-source-port 80 -j redirect --redirect-target DROP
${EBTABLES} -t broute -A BROUTING -i $INTDEV -p ipv4 --ip-protocol tcp
--ip-destination-port 80 -j redirect --redirect-target DROP
${IPTABLES} -F
${IPTABLES} -F -t nat
${IPTABLES} -F -t mangle
${IPTABLES} -v -t mangle -N DIVERT
${IPTABLES} -v -t mangle -A DIVERT -j MARK --set-mark 1
${IPTABLES} -v -t mangle -A DIVERT -j ACCEPT
${IPTABLES} -v -t mangle -A PREROUTING -p tcp -m socket -j DIVERT
${IPTABLES} -v -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY
--tproxy-mark 0x1/0x1 --on-port 3129
${IPTABLES} -I INPUT -s $SERVERIP -i br0 -j REJECT
${IPTABLES} -A INPUT -m state --state INVALID -j DROP
${IPTABLES} -A INPUT -s xxx.xxx.xxx.0/24 -j ACCEPT
${IPTABLES} -I INPUT -i lo -j ACCEPT
${IPTABLES} -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
${IPTABLES} -A INPUT -j DROP
ip rule add fwmark 1 lookup 100
ip route add local 0.0.0.0/0 dev lo table 100
sysctl -w net.ipv4.ip_nonlocal_bind=1
sysctl -w net.ipv4.ip_forward=1