August 2010 - tproxy - lists.balabit.hu

Tproxy troubleshooting
by Angelo Compagnucci 27 Aug '10

27 Aug '10

Hi List, I'll try to understang what's not working in my setup. I'm trying to configure tproxy on an lan but I cannot get it working. I'll try to explain better. My setup is resumed in the following scheme: LAN --> TRPOXY + BRIDGE + SQUID --> Default gateway. I'm working on Ubuntu 9.10 with Squid 3.1. Squid and tproxy are correctly configured because I can read "Accepting spoofing http connections at ..." in chache.log. The configuration I set up is described at the page http://wiki.squid-cache.org/Features/Tproxy4. This is the script i use to configure everithing: CLIENT_IFACE=eth0 INET_IFACE=eth1 ifconfig $CLIENT_IFACE down ifconfig $INET_IFACE down ifconfig $CLIENT_IFACE 0.0.0.0 up ifconfig $INET_IFACE 0.0.0.0 up brctl addbr br0 brctl addif br0 $CLIENT_IFACE brctl addif br0 $INET_IFACE brctl stp br0 off dhclient br0 ip rule add fwmark 1 lookup 100 ip route add local 0.0.0.0/0 dev lo table 100 echo 0 > /proc/sys/net/ipv4/conf/lo/rp_filter echo 1 > /proc/sys/net/ipv4/ip_forward iptables -t mangle -N DIVERT iptables -t mangle -A DIVERT -j MARK --set-mark 1 iptables -t mangle -A DIVERT -j ACCEPT iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 3129 ebtables -t broute -A BROUTING -i $CLIENT_IFACE -p IPv4 --ip-proto tcp --ip-dport 80 -j redirect --redirect-target DROP ebtables -t broute -A BROUTING -i $INET_IFACE -p IPv4 --ip-proto tcp --ip-sport 80 -j redirect --redirect-target DROP cd /proc/sys/net/bridge/ for i in * do echo 0 > $i done unset i With this configuration TPROXY doesn't work, I can see packet count increase for TRPOXY target in iptables -L but nothing appears on access.log and every http request from clients times out. This configuration works when I change --redirect-target DROP to --redirect-target ACCEPT, but in this case I can observe a duplication on traffic un port 80 inspecting my gateway traffic flow. I'm really gratefull to anyoune that can help me. Angelo

1 0

Ziproxy with Tproxy problem-- Client IP spoofing does not work
by Masih Nilforoushan 26 Aug '10

26 Aug '10

Hi folks, I have implemented Ziproxy for HTTP compression and web acceleration on Ubuntu 9 with Kernel 2.6.35.3. I compiled the Kernel for tproxy and Socket match and implemented iptables with socket andredirect rules along with Iproute2 commands. I need to spoof the client IP addresses so that remote web servers can see the clients real IP addresses rather than Ziproxy's IP address. I couldn't find any specific document on the Internet stating that Ziproxy is compatible with tproxy. However, I compiled and installed everything from scratch without any errors. But the problem is that when I add the following lines into iptables, my ziproxy does not respond to clients request any more and they can browse anything. iptables -t mangle -N DIVERT iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT iptables -t mangle -A DIVERT -j MARK --set-mark 1 iptables -t mangle -A DIVERT -j ACCEPT iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 8080 I traced the problem and find out that my box does not operate with tproxy. When it receives the clients request , it doesn't respond and doesn't open any socket towards the remote server. Can anybody please tell me if Ziproxy supports tproxy and IP spoofing? If it supports, what is wrong with my implementation? Thanks, Masih

1 0

problem with Hotmail and Facebook
by Carlos Botejara 23 Aug '10

23 Aug '10

Hello. I comment a bit my scenario I suando fedora core 11, LUSCA_HEAD-r14733 squid, dnsmasq the server is serving about 800 users, with a bandwidth of 60 MB. This server works in bridge mode with PUBLIC IP. The problem is that since the first days of August, I received complaints from users who can not enter HOTMAIL then validate your data, I mean that HOTMAIL cover charge, but when you validate the data, the connection and left hanging after a few minutes an error that says Connection reset by peer. And with Facebook, but can access the site, validate and review messages / photos, etc, is never loaded the list of online contacts, therefore the user can not chat. Not so with the pages of banks, or gmail, they have their chat embedded in the site. I make this clarification because any of the above sites, work with HTTPS. Reading this forum, make a tag mension within the SERVER_HTTP11 squid is ON. Place this option in my squid.conf, but got no positive results. has happened to someone? any ideas?.

1 0

./configure --enable-linux-netfilter
by Mamadou Touré 16 Aug '10

16 Aug '10

hi, when configuring squid-3.0.14 with --enable-linux-netfilter and i got this error: configure:27511: checking for linux/netfilter_ipv4/ip_tproxy.h configure:27565: g++ -c -g -O2 conftest.cpp >&5 conftest.cpp:33:1: warning: "USE_DISKIO_AIO" redefined conftest.cpp:30:1: warning: this is the location of the previous definition conftest.cpp:34:1: warning: "USE_DISKIO_DISKTHREADS" redefined conftest.cpp:31:1: warning: this is the location of the previous definition conftest.cpp:169:44: error: linux/netfilter_ipv4/ip_tproxy.h: No such file or directory configure:27572: $? = 1 configure: failed program was: can some one tell me how to solve. regards.

2 1

bridge + Squid + Tproxy
by Mamadou Touré 12 Aug '10

12 Aug '10

Hi all, i've implemented squid with tproxy on a linux bridge for transparent proxy of my clients . Internet-----router------squid(bridge)-----Router-------client i've made these config: +++++++++++++++++++++++++++++++++++++++++++++++ ip rule add fwmark 1 lookup 100 ip route add local 0.0.0.0/0 dev lo table 100 echo 0 > /proc/sys/net/ipv4/conf/lo/rp_filter echo 1 > /proc/sys/net/ipv4/ip_forward iptables -t mangle -N DIVERT iptables -t mangle -A DIVERT -j MARK --set-mark 1 iptables -t mangle -A DIVERT -j ACCEPT iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 3129 ebtables -t broute -A BROUTING -i $CLIENT_IFACE -p ipv4 --ip-proto tcp --ip-dport 80 -j redirect --redirect-target DROP cd /proc/sys/net/bridge/ for i in * do echo 0 > $i done unset i +++++++++++++++++++++++++++++++++++++++++++++++++++++ But my client cannot browse on internet in access log i got TCP_MISS/504 error. can someone help me ? regards

1 0

Re: [tproxy] Squid, TPROXY and SquidGuard
by Mamadou Touré 09 Aug '10

09 Aug '10

Notice that when i'm not in TPROXY mode ie standaard acces on port 3128. access are logged in access.log and my contents are filtered. this may meen that there is no probleme with squidGuard Config and squid. the problem may be with TPROXY. when configuring Squid-3 source as: ./configure --enable-linux-netfilter In the config log I can see : error: linux/netfilter_ipv4/ip_tproxy.h: No such file or directory Is this normal ? regards.

1 0

Squid, TPROXY and SquidGuard
by Mamadou Touré 09 Aug '10

09 Aug '10

hi all i'm about to implement a transparent content filtering using squid tproxy and squidGuard. I've tried this: squid.conf: ++++++++++++++++++++++++++++++++++++++++++++ http_port 3129 tproxy redirect_program /usr/local/bin/squidGuard -c /usr/local/squidGuard/squidGuard.conf -d redirect_children 10 +++++++++++++++++++++++++++++++++++++++++++++++++ my squidGuard.conf +++++++++++++++++++++++++++++++++++++++++++++++++++++ ..... dest porn { domainlist porn/domains urllist porn/urls expressionlist porn/expressions redirect http://localhost/denied.bl } acl { winxp_1 { pass !porn any } default { pass any } } ...... +++++++++++++++++++++++++++++++++++++++++++++++++++ HTTP traffic are redirect with: +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 3129 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ I think that My traffic passthrougth squid. Because my LAN machine can browse Internet. But the contents are not filtered because the user can access porn site. Also access are not logged in access.log. Does some one already implement such config ? Can someone help me? regards.

2 1