January 2010 - tproxy - lists.balabit.hu

EADDRNOTAVAIL from connect, but only sometimes
by Ron Parker 15 Apr '10

15 Apr '10

Hi, We are using the tproxy patch for Linux 2.6.24 (Ubuntu 8.0.4). When placing outgoing connections, we use the original socket address (4-tuple) in the bind and set SO_REUSEADDR on the socket. The sequence we are having difficulty with is: * Client connects to transparent proxy * Transparent proxy connects to remote server * Normal data transfer... * Remote server closes the connection (but client connection is maintained) * Transparent proxy attempts to connect again to remote server using the original 4-tuple (again) o Bind succeeds o Connect fails with EADDRNOTAVAIL The original socket is probably in TIME_WAIT at this point. I thought the SO_REUSEADDR would take care of the problem. What am I missing here? Thanks. Ron

3 4

TPROXY behavior when there is no listening socket at the target port
by Ashwani Wason 15 Apr '10

15 Apr '10

Hi All, If one has a TPROXY rule that redirects the packets to a local socket on which there is no one listening then the SYN packets keep getting dropped silently. Is this expected? Without knowing that this would happen my natural expectation was that a RST would be sent by local TCP. Is this by design or a bug? Thanks, - Ashwani

2 1

How does 'dev lo' in tproxy routing rule really work?
by Ashwani Wason 15 Apr '10

15 Apr '10

I want to understand the tproxy rules that have been kindly written for us in http://www.balabit.com/downloads/files/tproxy/README.txt. I understand every aspect of those rules, iptables and iproute2, except this one small highlighted bit in the last rule. ip route add local 0.0.0.0/0 *dev lo* table 100 # ip route show table 100 local default dev lo scope host So packets with fwmark 1 get selected for this routing table, which assumes that all destinations are assigned to this host and hence delivers the packets locally. But the output device is set to 'lo', which is the local loopback device. However even if the proxy is not listening on the IP of lo (say it only has the socket for eth0 and the packet came in on eth0), it still receives the packet. So is the 'lo' here just a way to indicate local delivery to the associated physical interface and does not really represent the actual output interface? Can someone please shed some light on this that is more than a simple yes/no answer? Thank you, - Ashwani

2 1

Configuration problems
by Stelian Ionescu 29 Jan '10

29 Jan '10

Hello, I'm using kernel 2.6.29 with iptables 1.4.6 and I'm trying to setup a minimal TPROXY. Basically, I've configured another (physical) machine to use my computer as default gateway, then on my machine I've enabled ip_forward and disabled rp_filter everywhere and using these rules: ip rule add fwmark 1 lookup 100 ip route add local 0.0.0.0/0 dev lo table 100 iptables -t mangle -A PREROUTING -p tcp -m tcp --dport 80 -j TPROXY --on-port 9999 --tproxy-mark 0x1/0x1 There are no other iptables rules, and all chains default to ACCEPT Then, on the remote machine I try to telnet google.com 80, but the connection can't be established. Tcpdump shows that SYN packets arrive but then it's as if they were dropped: they aren't getting to the proxy on port 9999. Any ideas ? -- Stelian Ionescu a.k.a. fe[nl]ix Quidquid latine dictum sit, altum videtur. http://common-lisp.net/project/iolib

2 2

Tproxy + NTLM + squid
by Adnan Shahzad 29 Jan '10

29 Jan '10

Dear All, I configured Tproxy with squid + NTLM + AD, everything works fine.... My problem is that "HTTPS" .... https request Time out and when I remove only secure portion in Browser setting it work fine.. Kindly help me Access.log: 1264582167.890 3 10.10.0.40 TCP_DENIED/407 7673 CONNECT www.google.com:443 - NONE/- text/html 1264582167.900 5 10.10.0.40 TCP_DENIED/407 7883 CONNECT www.google.com:443 - NONE/- text/html 1264582174.569 3 10.10.0.40 TCP_DENIED/407 7673 GET http://mail.yahoo.com/ - NONE/- text/html 1264582174.580 6 10.10.0.40 TCP_DENIED/407 7883 GET http://mail.yahoo.com/ - NONE/- text/html 1264582175.616 1026 10.10.0.40 TCP_MISS/302 700 GET http://mail.yahoo.com/ mydomain\Username DIRECT/69.147.112.160 text/html 1264582175.625 4 10.10.0.40 TCP_DENIED/407 7673 CONNECT login.yahoo.com:443 - NONE/- text/html 1264582175.636 7 10.10.0.40 TCP_DENIED/407 7883 CONNECT login.yahoo.com:443 - NONE/- text/html 1264582177.020 4 10.10.0.40 TCP_DENIED/407 7673 CONNECT login.facebook.com:443 - NONE/- text/html 1264582177.030 5 10.10.0.40 TCP_DENIED/407 7883 CONNECT login.facebook.com:443 - NONE/- text/html 1264582214.286 5 10.10.0.40 TCP_DENIED/403 378 GET http://91.212.226.182/loader.exe - NONE/- text/html 1264582223.319 46277 10.10.0.40 TCP_MISS/000 0 CONNECT login.facebook.com:443 MYDOMAIN\USERNAME NONE/- - 1264582223.338 8 10.10.0.40 TCP_DENIED/407 7673 CONNECT login.facebook.com:443 - NONE/- text/html 1264582223.366 13 10.10.0.40 TCP_DENIED/407 7883 CONNECT login.facebook.com:443 - NONE/- text/html 1264582227.958 60055 10.10.0.40 TCP_MISS/504 0 CONNECT www.google.com:443 MYDOMAIN\USERNAME DIRECT/216.239.61.104 - 1264582235.984 1 10.10.0.40 TCP_DENIED/407 7673 CONNECT login.facebook.com:443 - NONE/- text/html 1264582235.993 2 10.10.0.40 TCP_DENIED/407 7883 CONNECT login.facebook.com:443 - NONE/- text/html 1264582238.832 2 10.10.0.40 TCP_DENIED/407 7673 GET http://mail.yahoo.com/ - NONE/- text/html 1264582238.842 4 10.10.0.40 TCP_DENIED/407 7883 GET http://mail.yahoo.com/ - NONE/- text/html 1264582240.098 1246 10.10.0.40 TCP_MISS/302 700 GET http://mail.yahoo.com/ MYDOMAIN\USERNAME DIRECT/69.147.112.160 text/html 1264582240.104 2 10.10.0.40 TCP_DENIED/407 7673 CONNECT login.yahoo.com:443 - NONE/- text/html 1264582240.113 4 10.10.0.40 TCP_DENIED/407 7883 CONNECT login.yahoo.com:443 - NONE/- text/html 1264582304.251 1 10.10.0.40 TCP_DENIED/407 7673 GET http://mail.yahoo.com/ - NONE/- text/html 1264582304.262 4 10.10.0.40 TCP_DENIED/407 7883 GET http://mail.yahoo.com/ - NONE/- text/html 1264582305.793 1513 10.10.0.40 TCP_MISS/302 698 GET http://mail.yahoo.com/ MYDOMAIN\USERNAME DIRECT/69.147.112.160 text/html 1264582305.800 4 10.10.0.40 TCP_DENIED/407 7673 CONNECT login.yahoo.com:443 - NONE/- text/html 1264582305.810 4 10.10.0.40 TCP_DENIED/407 7883 CONNECT login.yahoo.com:443 - NONE/- text/html

2 1

Re: [tproxy] tproxy Digest, Vol 55, Issue 6
by Luiz Biazus 13 Jan '10

13 Jan '10

my first configuration was with all disabled : > echo 0 > /proc/sys/net/ipv4/conf/eth0/rp_filter > echo 0 > /proc/sys/net/ipv4/conf/eth1/rp_filter > echo 0 > /proc/sys/net/ipv4/conf/br0/rp_filter > echo 0 > /proc/sys/net/ipv4/conf/lo/rp_filter i enable it to make the test that u said! so doesn't work :-( Thank you friend Luiz 2010/1/13 <tproxy-request(a)lists.balabit.hu>: > Send tproxy mailing list submissions to > tproxy(a)lists.balabit.hu > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.balabit.hu/mailman/listinfo/tproxy > or, via email, send a message with subject or body 'help' to > tproxy-request(a)lists.balabit.hu > > You can reach the person managing the list at > tproxy-owner(a)lists.balabit.hu > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of tproxy digest..." > > > Today's Topics: > > 1. Re: tproxy Digest, Vol 55, Issue 5 (Luiz Biazus) > 2. Re: tproxy Digest, Vol 55, Issue 5 (KOVACS Krisztian) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 12 Jan 2010 09:27:52 -0200 > From: Luiz Biazus <luiz(a)biazus.com> > Subject: Re: [tproxy] tproxy Digest, Vol 55, Issue 5 > To: tproxy(a)lists.balabit.hu > Message-ID: > <8ecc30771001120327t20156525nae58961884b9ea8a(a)mail.gmail.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Hello Krisztian! > > is that what i mean! > > follow my full configuration: > > echo 1 > /proc/sys/net/ipv4/ip_forward > echo 1 > /proc/sys/net/ipv4/ip_nonlocal_bind > echo 1 > /proc/sys/net/ipv4/conf/eth0/rp_filter > echo 1 > /proc/sys/net/ipv4/conf/eth1/rp_filter > echo 1 > /proc/sys/net/ipv4/conf/br0/rp_filter > echo 1 > /proc/sys/net/ipv4/conf/lo/rp_filter > echo 1 > /proc/sys/net/ipv4/conf/all/forwarding > echo 1 > /proc/sys/net/ipv4/conf/all/send_redirects > > > cd /proc/sys/net/bridge/ > for i in * > do > echo 0 > $i > done > unset i > > > > iptables -t mangle -N DIVERT > iptables -t mangle -A DIVERT -j MARK --set-mark 1 > iptables -t mangle -A DIVERT -j ACCEPT > iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT > iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY > --tproxy-mark 0x1/0x1 --on-port 8012 > ebtables -t broute -A BROUTING -i eth1 -p ipv4 --ip-proto tcp > --ip-dport 80 -j redirect --redirect-target DROP > ebtables -t broute -A BROUTING -i eth0 -p ipv4 --ip-proto tcp > --ip-sport 80 -j redirect --redirect-target DROP > //eth0 connected to gw and eth1 internal > > > ip rule add dev eth0 fwmark 1 lookup 100 > ip rule add dev eth1 fwmark 1 lookup 100 > ip rule add dev br0 fwmark 1 lookup 100 > > > root@cache:~# ip rule > 0: from all lookup local > 32763: from all fwmark 0x1 iif eth0 lookup 100 > 32764: from all fwmark 0x1 iif eth1 lookup 100 > 32765: from all fwmark 0x1 iif br0 lookup 100 > 32766: from all lookup main > 32767: from all lookup default > > root@thundercache:~# ip route show all > 189.10.205.0/24 dev br0 proto kernel scope link src 189.10.205.3 > default via 189.10.205.1 dev br0 metric 100 > > > > root@thundercache:~# ifconfig > br0 Link encap:Ethernet Endere??o de HW 00:06:4f:5f:b3:1e > inet end.: 189.10.205.3 Bcast:189.10.203.255 Masc:255.255.255.0 > endere??o inet6: fe80::206:4fff:fe5f:b31e/64 Escopo:Link > UP BROADCAST RUNNING MULTICAST MTU:1500 M??trica:1 > pacotes RX:2314056 erros:0 descartados:0 excesso:0 quadro:0 > Pacotes TX:686243 erros:0 descartados:0 excesso:0 portadora:0 > colis??es:0 txqueuelen:0 > RX bytes:640911673 (640.9 MB) TX bytes:499301746 (499.3 MB) > > eth0 Link encap:Ethernet Endere??o de HW 00:06:4f:5f:b3:1e > endere??o inet6: fe80::206:4fff:fe5f:b31e/64 Escopo:Link > UP BROADCAST RUNNING MULTICAST MTU:1500 M??trica:1 > pacotes RX:197138752 erros:0 descartados:0 excesso:0 quadro:0 > Pacotes TX:171287420 erros:0 descartados:0 excesso:0 portadora:0 > colis??es:0 txqueuelen:1000 > RX bytes:1122327687 (1.1 GB) TX bytes:1558614907 (1.5 GB) > IRQ:18 > > eth1 Link encap:Ethernet Endere??o de HW 00:1e:8c:d2:2e:e9 > endere??o inet6: fe80::21e:8cff:fed2:2ee9/64 Escopo:Link > UP BROADCAST RUNNING MULTICAST MTU:1500 M??trica:1 > pacotes RX:171297851 erros:1 descartados:0 excesso:0 quadro:1 > Pacotes TX:197160512 erros:0 descartados:0 excesso:0 portadora:0 > colis??es:0 txqueuelen:1000 > RX bytes:1561386827 (1.5 GB) TX bytes:1915548351 (1.9 GB) > IRQ:25 Endere??o de E/S:0x4000 > > lo Link encap:Loopback Local > inet end.: 127.0.0.1 Masc:255.0.0.0 > endere??o inet6: ::1/128 Escopo:M??quina > UP LOOPBACK RUNNING MTU:16436 M??trica:1 > pacotes RX:40 erros:0 descartados:0 excesso:0 quadro:0 > Pacotes TX:40 erros:0 descartados:0 excesso:0 portadora:0 > colis??es:0 txqueuelen:0 > RX bytes:3690 (3.6 KB) TX bytes:3690 (3.6 KB) > > > > Thank you Friend! > > > Bst Rgds > Luiz > > > > 2010/1/12 <tproxy-request(a)lists.balabit.hu>: >> Send tproxy mailing list submissions to >> ? ? ? ?tproxy(a)lists.balabit.hu >> >> To subscribe or unsubscribe via the World Wide Web, visit >> ? ? ? ?https://lists.balabit.hu/mailman/listinfo/tproxy >> or, via email, send a message with subject or body 'help' to >> ? ? ? ?tproxy-request(a)lists.balabit.hu >> >> You can reach the person managing the list at >> ? ? ? ?tproxy-owner(a)lists.balabit.hu >> >> When replying, please edit your Subject line so it is more specific >> than "Re: Contents of tproxy digest..." >> >> >> Today's Topics: >> >> ? 1. Re: tproxy Digest, Vol 55, Issue 4 (Luiz Biazus) >> ? 2. Re: tproxy Digest, Vol 55, Issue 4 (KOVACS Krisztian) >> >> >> ---------------------------------------------------------------------- >> >> Message: 1 >> Date: Mon, 11 Jan 2010 09:05:25 -0200 >> From: Luiz Biazus <luiz(a)biazus.com> >> Subject: Re: [tproxy] tproxy Digest, Vol 55, Issue 4 >> To: tproxy(a)lists.balabit.hu >> Message-ID: >> ? ? ? ?<8ecc30771001110305l2ab305e4h757f48a39fc97d95(a)mail.gmail.com> >> Content-Type: text/plain; charset=ISO-8859-1 >> >> about this procedures: >> >> ?ip rule add dev eth0 fwmark 1 lookup 100 >> ?ip rule add dev eth1 fwmark 1 lookup 100 >> ?ip rule add dev br0 fwmark 1 lookup 100 >> >> >> It doesnt works >> >> >> Thank you ?Krisztian >> >> >> >> >> >> 2010/1/11 ?<tproxy-request(a)lists.balabit.hu>: >>> Send tproxy mailing list submissions to >>> ? ? ? ?tproxy(a)lists.balabit.hu >>> >>> To subscribe or unsubscribe via the World Wide Web, visit >>> ? ? ? ?https://lists.balabit.hu/mailman/listinfo/tproxy >>> or, via email, send a message with subject or body 'help' to >>> ? ? ? ?tproxy-request(a)lists.balabit.hu >>> >>> You can reach the person managing the list at >>> ? ? ? ?tproxy-owner(a)lists.balabit.hu >>> >>> When replying, please edit your Subject line so it is more specific >>> than "Re: Contents of tproxy digest..." >>> >>> >>> Today's Topics: >>> >>> ? 1. EADDRNOTAVAIL from connect, but only sometimes (Ron Parker) >>> ? 2. Re: Correct kernel version with tproxy (KOVACS Krisztian) >>> >>> >>> ---------------------------------------------------------------------- >>> >>> Message: 1 >>> Date: Sun, 10 Jan 2010 19:46:58 -0500 >>> From: Ron Parker <rparker(a)movik.net> >>> Subject: [tproxy] EADDRNOTAVAIL from connect, but only sometimes >>> To: "tproxy(a)lists.balabit.hu" <tproxy(a)lists.balabit.hu> >>> Message-ID: >>> ? ? ? ?<5D6AFCAC2AD9424D816711D1AF4FE8441BDE791924(a)MAILR014.mail.lan> >>> Content-Type: text/plain; charset="us-ascii" >>> >>> Hi, >>> >>> We are using the tproxy patch for Linux 2.6.24 (Ubuntu 8.0.4). ? When placing outgoing connections, we use the original socket address (4-tuple) ?in the bind and set SO_REUSEADDR on the socket. ? The sequence we are having difficulty with is: >>> >>> >>> * ? ? ? ? Client connects to transparent proxy >>> >>> * ? ? ? ? Transparent proxy connects to remote server >>> >>> * ? ? ? ? Normal data transfer... >>> >>> * ? ? ? ? Remote server closes the connection (but client connection is maintained) >>> >>> * ? ? ? ? Transparent proxy attempts to connect again to remote server using the original 4-tuple (again) >>> >>> o ? Bind succeeds >>> >>> o ? Connect fails with EADDRNOTAVAIL >>> >>> The original socket is probably in TIME_WAIT at this point. ? I thought the SO_REUSEADDR would take care of the problem. ?What am I missing here? >>> >>> Thanks. >>> >>> ? Ron >>>

1 0

Re: [tproxy] tproxy Digest, Vol 55, Issue 5
by Luiz Biazus 12 Jan '10

12 Jan '10

Hello Krisztian! is that what i mean! follow my full configuration: echo 1 > /proc/sys/net/ipv4/ip_forward echo 1 > /proc/sys/net/ipv4/ip_nonlocal_bind echo 1 > /proc/sys/net/ipv4/conf/eth0/rp_filter echo 1 > /proc/sys/net/ipv4/conf/eth1/rp_filter echo 1 > /proc/sys/net/ipv4/conf/br0/rp_filter echo 1 > /proc/sys/net/ipv4/conf/lo/rp_filter echo 1 > /proc/sys/net/ipv4/conf/all/forwarding echo 1 > /proc/sys/net/ipv4/conf/all/send_redirects cd /proc/sys/net/bridge/ for i in * do echo 0 > $i done unset i iptables -t mangle -N DIVERT iptables -t mangle -A DIVERT -j MARK --set-mark 1 iptables -t mangle -A DIVERT -j ACCEPT iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 8012 ebtables -t broute -A BROUTING -i eth1 -p ipv4 --ip-proto tcp --ip-dport 80 -j redirect --redirect-target DROP ebtables -t broute -A BROUTING -i eth0 -p ipv4 --ip-proto tcp --ip-sport 80 -j redirect --redirect-target DROP //eth0 connected to gw and eth1 internal ip rule add dev eth0 fwmark 1 lookup 100 ip rule add dev eth1 fwmark 1 lookup 100 ip rule add dev br0 fwmark 1 lookup 100 root@cache:~# ip rule 0: from all lookup local 32763: from all fwmark 0x1 iif eth0 lookup 100 32764: from all fwmark 0x1 iif eth1 lookup 100 32765: from all fwmark 0x1 iif br0 lookup 100 32766: from all lookup main 32767: from all lookup default root@thundercache:~# ip route show all 189.10.205.0/24 dev br0 proto kernel scope link src 189.10.205.3 default via 189.10.205.1 dev br0 metric 100 root@thundercache:~# ifconfig br0 Link encap:Ethernet EndereÃ§o de HW 00:06:4f:5f:b3:1e inet end.: 189.10.205.3 Bcast:189.10.203.255 Masc:255.255.255.0 endereÃ§o inet6: fe80::206:4fff:fe5f:b31e/64 Escopo:Link UP BROADCAST RUNNING MULTICAST MTU:1500 MÃ©trica:1 pacotes RX:2314056 erros:0 descartados:0 excesso:0 quadro:0 Pacotes TX:686243 erros:0 descartados:0 excesso:0 portadora:0 colisÃµes:0 txqueuelen:0 RX bytes:640911673 (640.9 MB) TX bytes:499301746 (499.3 MB) eth0 Link encap:Ethernet EndereÃ§o de HW 00:06:4f:5f:b3:1e endereÃ§o inet6: fe80::206:4fff:fe5f:b31e/64 Escopo:Link UP BROADCAST RUNNING MULTICAST MTU:1500 MÃ©trica:1 pacotes RX:197138752 erros:0 descartados:0 excesso:0 quadro:0 Pacotes TX:171287420 erros:0 descartados:0 excesso:0 portadora:0 colisÃµes:0 txqueuelen:1000 RX bytes:1122327687 (1.1 GB) TX bytes:1558614907 (1.5 GB) IRQ:18 eth1 Link encap:Ethernet EndereÃ§o de HW 00:1e:8c:d2:2e:e9 endereÃ§o inet6: fe80::21e:8cff:fed2:2ee9/64 Escopo:Link UP BROADCAST RUNNING MULTICAST MTU:1500 MÃ©trica:1 pacotes RX:171297851 erros:1 descartados:0 excesso:0 quadro:1 Pacotes TX:197160512 erros:0 descartados:0 excesso:0 portadora:0 colisÃµes:0 txqueuelen:1000 RX bytes:1561386827 (1.5 GB) TX bytes:1915548351 (1.9 GB) IRQ:25 EndereÃ§o de E/S:0x4000 lo Link encap:Loopback Local inet end.: 127.0.0.1 Masc:255.0.0.0 endereÃ§o inet6: ::1/128 Escopo:MÃ¡quina UP LOOPBACK RUNNING MTU:16436 MÃ©trica:1 pacotes RX:40 erros:0 descartados:0 excesso:0 quadro:0 Pacotes TX:40 erros:0 descartados:0 excesso:0 portadora:0 colisÃµes:0 txqueuelen:0 RX bytes:3690 (3.6 KB) TX bytes:3690 (3.6 KB) Thank you Friend! Bst Rgds Luiz 2010/1/12 <tproxy-request(a)lists.balabit.hu>: > Send tproxy mailing list submissions to > tproxy(a)lists.balabit.hu > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.balabit.hu/mailman/listinfo/tproxy > or, via email, send a message with subject or body 'help' to > tproxy-request(a)lists.balabit.hu > > You can reach the person managing the list at > tproxy-owner(a)lists.balabit.hu > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of tproxy digest..." > > > Today's Topics: > > 1. Re: tproxy Digest, Vol 55, Issue 4 (Luiz Biazus) > 2. Re: tproxy Digest, Vol 55, Issue 4 (KOVACS Krisztian) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 11 Jan 2010 09:05:25 -0200 > From: Luiz Biazus <luiz(a)biazus.com> > Subject: Re: [tproxy] tproxy Digest, Vol 55, Issue 4 > To: tproxy(a)lists.balabit.hu > Message-ID: > <8ecc30771001110305l2ab305e4h757f48a39fc97d95(a)mail.gmail.com> > Content-Type: text/plain; charset=ISO-8859-1 > > about this procedures: > > ip rule add dev eth0 fwmark 1 lookup 100 > ip rule add dev eth1 fwmark 1 lookup 100 > ip rule add dev br0 fwmark 1 lookup 100 > > > It doesnt works > > > Thank you Krisztian > > > > > > 2010/1/11 <tproxy-request(a)lists.balabit.hu>: >> Send tproxy mailing list submissions to >> ? ? ? ?tproxy(a)lists.balabit.hu >> >> To subscribe or unsubscribe via the World Wide Web, visit >> ? ? ? ?https://lists.balabit.hu/mailman/listinfo/tproxy >> or, via email, send a message with subject or body 'help' to >> ? ? ? ?tproxy-request(a)lists.balabit.hu >> >> You can reach the person managing the list at >> ? ? ? ?tproxy-owner(a)lists.balabit.hu >> >> When replying, please edit your Subject line so it is more specific >> than "Re: Contents of tproxy digest..." >> >> >> Today's Topics: >> >> ? 1. EADDRNOTAVAIL from connect, but only sometimes (Ron Parker) >> ? 2. Re: Correct kernel version with tproxy (KOVACS Krisztian) >> >> >> ---------------------------------------------------------------------- >> >> Message: 1 >> Date: Sun, 10 Jan 2010 19:46:58 -0500 >> From: Ron Parker <rparker(a)movik.net> >> Subject: [tproxy] EADDRNOTAVAIL from connect, but only sometimes >> To: "tproxy(a)lists.balabit.hu" <tproxy(a)lists.balabit.hu> >> Message-ID: >> ? ? ? ?<5D6AFCAC2AD9424D816711D1AF4FE8441BDE791924(a)MAILR014.mail.lan> >> Content-Type: text/plain; charset="us-ascii" >> >> Hi, >> >> We are using the tproxy patch for Linux 2.6.24 (Ubuntu 8.0.4). ? When placing outgoing connections, we use the original socket address (4-tuple) ?in the bind and set SO_REUSEADDR on the socket. ? The sequence we are having difficulty with is: >> >> >> * ? ? ? ? Client connects to transparent proxy >> >> * ? ? ? ? Transparent proxy connects to remote server >> >> * ? ? ? ? Normal data transfer... >> >> * ? ? ? ? Remote server closes the connection (but client connection is maintained) >> >> * ? ? ? ? Transparent proxy attempts to connect again to remote server using the original 4-tuple (again) >> >> o ? Bind succeeds >> >> o ? Connect fails with EADDRNOTAVAIL >> >> The original socket is probably in TIME_WAIT at this point. ? I thought the SO_REUSEADDR would take care of the problem. ?What am I missing here? >> >> Thanks. >> >> ? Ron >>

2 1

Re: [tproxy] tproxy Digest, Vol 55, Issue 4
by Luiz Biazus 11 Jan '10

11 Jan '10

about this procedures: ip rule add dev eth0 fwmark 1 lookup 100 ip rule add dev eth1 fwmark 1 lookup 100 ip rule add dev br0 fwmark 1 lookup 100 It doesnt works Thank you Krisztian 2010/1/11 <tproxy-request(a)lists.balabit.hu>: > Send tproxy mailing list submissions to > tproxy(a)lists.balabit.hu > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.balabit.hu/mailman/listinfo/tproxy > or, via email, send a message with subject or body 'help' to > tproxy-request(a)lists.balabit.hu > > You can reach the person managing the list at > tproxy-owner(a)lists.balabit.hu > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of tproxy digest..." > > > Today's Topics: > > 1. EADDRNOTAVAIL from connect, but only sometimes (Ron Parker) > 2. Re: Correct kernel version with tproxy (KOVACS Krisztian) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sun, 10 Jan 2010 19:46:58 -0500 > From: Ron Parker <rparker(a)movik.net> > Subject: [tproxy] EADDRNOTAVAIL from connect, but only sometimes > To: "tproxy(a)lists.balabit.hu" <tproxy(a)lists.balabit.hu> > Message-ID: > <5D6AFCAC2AD9424D816711D1AF4FE8441BDE791924(a)MAILR014.mail.lan> > Content-Type: text/plain; charset="us-ascii" > > Hi, > > We are using the tproxy patch for Linux 2.6.24 (Ubuntu 8.0.4). When placing outgoing connections, we use the original socket address (4-tuple) in the bind and set SO_REUSEADDR on the socket. The sequence we are having difficulty with is: > > > * Client connects to transparent proxy > > * Transparent proxy connects to remote server > > * Normal data transfer... > > * Remote server closes the connection (but client connection is maintained) > > * Transparent proxy attempts to connect again to remote server using the original 4-tuple (again) > > o Bind succeeds > > o Connect fails with EADDRNOTAVAIL > > The original socket is probably in TIME_WAIT at this point. I thought the SO_REUSEADDR would take care of the problem. What am I missing here? > > Thanks. > > Ron >

2 1

Correct kernel version with tproxy
by Alexandre Correa 11 Jan '10

11 Jan '10

What´s the best version of kernel for using tproxy ? 2.6.{28|29|30|31} ? seems with 2.6.32 has issues with.. true ? regadrs. -- Sds. Alexandre J. Correa Onda Internet http://www.onda.net.br IPV6 Ready !!! http://ipv6.onda.net.br

2 1

Fwd: Funny Tproxy ISSUE with ip route lost communication
by Luiz Biazus 09 Jan '10

09 Jan '10

Thanks for Reply Krisztian after i insert this rules: ip rule add dev eth0 fwmark 1 lookup 100 ip rule add dev eth1 fwmark 1 lookup 100 ip rule add dev br0 fwmark 1 lookup 100 i must to insert this route: ip route add local 0.0.0.0/0 dev lo table 100 or dont? 2010/1/8 KOVACS Krisztian <hidden(a)balabit.hu>: > Hi, > > On 01/07/2010 11:56 AM, Luiz Biazus wrote: >> >> let me explain what is funny >> i have this plataform: >> >> ubuntu 9.04 >> kernel 2.6.32 >> iptables 1.4.6 >> squid 3.1 running in port 8012 > >> >> [...] >> >> until here all is OK even i can UP all this rulles that i discribe >> before and every thing seems to be OK! >> >> BUT! >> >> >> if i up THIS RULES: >> >> ip rule add fwmark 1 lookup 100 >> ip route add local 0.0.0.0/0 dev lo table 100 >> >> I LOST COMMUNICATION WITH MY PROXY > > I'm afraid this was caused by Jamal's rp_filter change committed in Linux > 2.6.32. > > You can find more information on the issue in the linux-netdev or tproxy > mailing list archives: > > http://marc.info/?l=linux-netdev&m=125925598910379&w=2 > > This is expected to be fixed in an upcoming -stable release (2.6.32.z), in > the meantime you can use the workaround mentioned in that mail thread: > instead of the 'ip rule add fwmark 1 lookup 100' rule, you have to use one > rule per interface. > > <quote> > The workaround is using more specific ip rules that include the ingress > interface name: > > # ip rule add dev eth0 fwmark 1 lookup 100 > > (repeat the above for each interface except lo.) > </quote> > > Hope this helps. > > Cheers, > Krisztian >

2 1