October 2010 - tproxy - lists.balabit.hu

Re: [tproxy] Easiest way to install tproxy on Ubuntu 10.04 for regular laymen users
by SM 23 Oct '10

23 Oct '10

Yes, it is!! Awesome. From the README.txt file, I was of the opinion that the kernel needs to be patched and compiled. I have the following scenario: All UDP packets *coming in and going out* of port 5060 need to be redirected to port 56789. An application running on port 56789 must parse them, modify them and send them to their intended destinations. I must take care that packets coming from remote machine to local machine:5060 are FIRST received at local machine:56789, and then, after modification, sent to local machine:5060 with a spoofed header suggesting that it came from remote machine. The incoming packets can be handled by this rule: iptables -t mangle -A PREROUTING -p udp --dport 5060 -j TPROXY --on-port 56789 --tproxy-mark 0x1/0x1 How should I handle the outgoing packets for 5060? Mangle table's OUTPUT rule does not take tproxy as a target. Thanks for your reply. --SM. On Fri, Oct 22, 2010 at 11:31 PM, Ken Simpson <ksimpson(a)mailchannels.com>wrote: > TProxy is built into the kernel in 10.04. > > On 2010-10-22, at 9:27 PM, SM wrote: > > > Hello, > > > > I was wondering what is the easiest way to install tproxy on Ubuntu > 10.04, instead of compiling the kernel after patching it. Is there any way > of accomplishing the same thing by kernel modules? Thank you for your early > response. > > > > Regards, > > SM. > > _______________________________________________ > > tproxy mailing list > > tproxy(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/tproxy > > Regards, > Ken > > -- > Ken Simpson > CEO, MailChannels > > www.mailchannels.com > > T +1 888 685 7488 > >

2 1

Easiest way to install tproxy on Ubuntu 10.04 for regular laymen users
by SM 23 Oct '10

23 Oct '10

Hello, I was wondering what is the easiest way to install tproxy on Ubuntu 10.04, instead of compiling the kernel after patching it. Is there any way of accomplishing the same thing by kernel modules? Thank you for your early response. Regards, SM.

1 0

Tproxy , wccp and squid
by hugo＠gigared.com 21 Oct '10

21 Oct '10

Dear people: I receive many mails about using Tproxy4 , wccpv2 and squid that config really works fine , with tested traffic up to 180Mbps. and is Stable , working 7x24 in the last year , first with squid version 3.1.0.14 a now with 3.1.8. Some minor problems when , for many reasons (spoofing, attacks, etc) the squid looses performances (for ex, from 80 to 20Mbps) the wccp do not derive the traffic direct to the internet until the network interface to the wccp-in is deactivated. but this is a rare situation (once or twice a month) i think that the mayor contribution to this application is to test in the real environ , passing to you all the info about. regarding , obviously, the economical contribution that the ISP that uses must do. in short again : if someone need more info about deployment, testing, etc etc , i think is better to do via this forum, in order to share the info with all of us. Thank you again Hugo ------------------------- www.gigared.com

1 0

Re: [tproxy] Kernel Panic/System Hang when using TPROXY with 2.6.27 or later
by KOVACS Krisztian 21 Oct '10

21 Oct '10

Hi, On Thu, 2010-10-21 at 16:16 +0200, FREY Oliver wrote: > Our product supports either proxying using iptables-REDIRECT-targets and > no TPROXY, or using iptables-TPROXY-targets and the TPROXY-support to > open the outgoing connection with the client's IP-address. > > Everything is working fine and systems are stable and running for months > when using the REDIRECT-targets. > Also everything looks to run fine when using the TPROXY-targets, but > unfortunately within 24-48 hours the system either hangs with a Kernel > Panic (we can also see some Soft-Lockup-Warnings before that) or > completely hangs, needing a manual reset. > Unfortunately we have no Kernel-development/debugging experience, but > all the warnings/panics point to kernel-memory-corruption, because by > now we had panics in virtually any system-function called that tries to > allocate/free kernel-memory - also once we had a Kernel with > slab-debug-messages enabled running and got messages that corruption was > detected, hours before the system finally paniced. > > The latest kernel we tried was 2.6.35.2, we also tried a few versions in > between, but stability did not change. > At application-level there is not much that has to be done (and can get > wrong) to use TPROXY-support, and the calls were implemented according > to sample-code. > > I do appreciate any help you can provide, as I've run out of ideas what > I could do to fix the issue. Well, there was a report of tproxy-triggered crashes on the linux netdev mailing list a few months ago. It might be the case that you're experiencing the same issue, but it's impossible to tell without knowing more details. We do have a patch which should fix that particular problem so maybe it would be worth giving that patch a try. You can get the patch here: http://git.balabit.hu/?p=hidden/tproxy-2.6.git;a=commit;h=4ccf010bd58417458… Please let me know if you're still having issues after applying the patch. Cheers, Krisztian

1 0

tproxy for ipv6
by Manila Goel 21 Oct '10

21 Oct '10

hi all, For ipv4 we hv written a tproxy code using NAT table. I want it do for ipv6 but NAT table doest support ipv6. If anyone has done any wrk on this. if anyone can give some idea, i will be greatfull for me. Thanks Mona -- :)

2 2

bypassing squid via iptables
by hugo＠gigared.com 21 Oct '10

21 Oct '10

hi all! im using tproxy on fedora 12 (kernel 2.6.31-6) with squid 3.1.8 on a wccp configuration using a cisco 3560. everything works really fine , except for some newly appeared web sites (or something like that) that abuses on http 1.1, and cause many customers requests. failed. in short: can i really bypass squid and send these requests directly to the internet? i believe that this is possible changing the pre-post routings rules of iptables and , giving the ip of the websites Thank you in advance. my sh executing iptables actual config : #!/bin/sh # squid server IP SQUID_SERVER="192.168.250.9" # Interface connected to LAN LAN_IN="eth5" # Interface connected to Internet INTERNET="eth7" # DO NOT MODIFY BELOW # Clean old firewall iptables -F iptables -X iptables -t nat -F iptables -t nat -X iptables -t mangle -F iptables -t mangle -X # ip rule add fwmark 1 lookup 100 ip route add local 0.0.0.0/0 dev lo table 100 # # Setting default filter policy iptables -P INPUT ACCEPT iptables -P OUTPUT ACCEPT # ############################################### # # TPROXY 4 Rules - router # ############################################## # #Setup a chain DIVERT to mark packets # iptables -t mangle -N DIVERT iptables -t mangle -A DIVERT -j MARK --set-mark 1 iptables -t mangle -A DIVERT -j ACCEPT ############################################### # # TPROXY 4 Rules - bridge # ############################################## # # Use DIVERT to prevent existing connections # going through TPROXY twice: # # iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT # # Mark all other (new) packets and use TPROXY to pass into Squid: # # iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 3129 # # iptables -A INPUT -i gre0 -j ACCEPT # iptables -A INPUT -p gre -j ACCEPT # # # ebtables -t broute -A BROUTING -i $LAN_IN -p ipv4 --ip-proto tcp --ip-dport 80 -j redirect --redirect-target DROP # # ebtables -t broute -A BROUTING -i $INTERNET -p ipv4 --ip-proto tcp --ip-sport 80 -j redirect --redirect-target DROP # # # # # cd /proc/sys/net/bridge/ for i in * do echo 0 > $i done unset i # ip ro flu ca ------------------------- www.gigared.com

1 0

Java & TPROXY
by Simon James 19 Oct '10

19 Oct '10

Hi Is it possible to combine use of TPROXY with a server written in Java? I cannot find a way of setting the IP_TRANSPARENT socket option from within Java. Regards Simon

2 1