- tproxy - lists.balabit.hu

tproxy patches for kernel 2.6.27
by Dejan Paradiž 24 Aug '09

24 Aug '09

Does anyone now where i can find tproxy patches for kernel 2.6.27 and patches for iptables 1.4.0 or higher.

2 1

help with tproxy.
by Marco Clocchiatti 19 Aug '09

19 Aug '09

I want to setup tproxy in my local net. I studied your howto: http://wiki.squid-cache.org/Features/Tproxy4 but I don't understand how to adapt it to my setup. I'm using squid-3.1.0.13_beta iptables-1.4.3.2 and kernel 2.6.30 from a gentoo distribution. I have a linear net topology: internet <----> 192.168.1.1 adsl router <----> 192.168.1.12 proxy server 192.168.0.12 <----> 192.168.0.13 local_client this is the routing table for the client: local_client ~ # route -en Kernel IP routing table Destination Gateway Genmask Flags MSS Window irtt Iface 192.168.0.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 127.0.0.0 127.0.0.1 255.0.0.0 UG 0 0 0 lo 0.0.0.0 192.168.0.12 0.0.0.0 UG 0 0 0 eth0 and this one for the proxy server: proxy_server ~ # ip route list table all local default dev lo table 100 scope host 192.168.1.0/24 dev eth1 proto kernel scope link src 192.168.1.12 192.168.0.0/24 dev eth0 proto kernel scope link src 192.168.0.12 127.0.0.0/8 via 127.0.0.1 dev lo default via 192.168.1.1 dev eth1 broadcast 192.168.0.255 dev eth0 table local proto kernel scope link src 192.168.0.12 broadcast 192.168.1.0 dev eth1 table local proto kernel scope link src 192.168.1.12 broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1 local 192.168.0.12 dev eth0 table local proto kernel scope host src 192.168.0.12 broadcast 192.168.0.0 dev eth0 table local proto kernel scope link src 192.168.0.12 broadcast 192.168.1.255 dev eth1 table local proto kernel scope link src 192.168.1.12 local 192.168.1.12 dev eth1 table local proto kernel scope host src 192.168.1.12 broadcast 127.0.0.0 dev lo table local proto kernel scope link src 127.0.0.1 local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1 local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1 proxy_server ~ # ip rule 0: from all lookup local 32765: from all fwmark 0x1 lookup 100 32766: from all lookup main 32767: from all lookup default this is my squid configuration: proxy_server ~ # grep -v ^# /etc/squid/squid.conf|grep -v ^$ acl manager proto cache_object acl localhost src 127.0.0.1/32 acl to_localhost dst 127.0.0.0/8 acl localnet src 10.0.0.0/8 # RFC1918 possible internal network acl localnet src 172.16.0.0/12 # RFC1918 possible internal network acl localnet src 192.168.0.0/16 # RFC1918 possible internal network acl SSL_ports port 443 acl Safe_ports port 80 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 # https acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl Safe_ports port 901 # SWAT acl purge method PURGE acl CONNECT method CONNECT http_access allow manager localhost http_access deny manager http_access allow purge localhost http_access deny purge http_access deny !Safe_ports http_access deny CONNECT !SSL_ports http_access allow localnet http_access allow localhost http_access allow localhost http_access deny all http_port 3128 http_port 3129 tproxy hierarchy_stoplist cgi-bin ? cache_dir diskd /var/cache/squid 50M 16 256 coredump_dir /var/cache/squid refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 refresh_pattern . 0 20% 4320 shutdown_lifetime 2 seconds visible_hostname proxy_server this is my iptables conf: proxy_server ~ # iptables -t mangle -L -n Chain PREROUTING (policy ACCEPT) target prot opt source destination DIVERT tcp -- 0.0.0.0/0 0.0.0.0/0 socket TPROXY tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 TPROXY redirect 192.168.1.12:3129 mark 0x1/0x1 Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain POSTROUTING (policy ACCEPT) target prot opt source destination Chain DIVERT (1 references) target prot opt source destination MARK all -- 0.0.0.0/0 0.0.0.0/0 MARK xset 0x1/0xffffffff ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 the following are commands to build this conf: iptables -t mangle -N DIVERT iptables -t mangle -A DIVERT -j MARK --set-mark 1 iptables -t mangle -A DIVERT -j ACCEPT iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 3129 --on-ip 192.168.1.12 ip rule add fwmark 1 lookup 100 ip route add local 0.0.0.0/0 dev lo table 100 echo 1 > /proc/sys/net/ipv4/ip_forward but all this does not works. the client does not ping out of 192.168.0.* : local_client ~ # ping 192.168.1.1 PING 192.168.1.1 (192.168.1.1) 56(84) bytes of data. ^C --- 192.168.1.1 ping statistics --- 87 packets transmitted, 0 received, 100% packet loss, time 85999ms squid works, but only for internet bots which are looking my home apache server: proxy_server ~ # tail -n 89 /var/log/squid/access.log -n1 1250664301.462 0 66.249.67.133 TCP_DENIED/403 3771 GET http://cloc3.dyndns.org/index.html/doku.php/22_dicembre_2008/problema4? - NONE/- text/html That's stupid: I want squid for the local users, not for remote hosts. Where I'm falling?

1 0

Re: [tproxy] Problems Caching
by Jose Oliveira de Almeida Filho 14 Aug '09

14 Aug '09

*squid.conf: *acl manager proto cache_object acl localhost src 127.0.0.1/32 acl to_localhost dst 127.0.0.0/8 acl localnet src 10.0.0.0/8 # RFC1918 possible internal network acl SSL_ports port 443 acl Safe_ports port 80 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 # https acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl CONNECT method CONNECT http_access allow manager localhost http_access deny manager http_access deny !Safe_ports http_access deny CONNECT !SSL_ports http_access allow localnet http_access allow localhost http_access deny all icp_access deny all htcp_access deny all http_port 3128 http_port 3129 tproxy hierarchy_stoplist cgi-bin ? cache_mem 100 MB cache_dir ufs /var/spool/squid 100 16 256 access_log /var/log/access.log squid cache_log /var/log/cache.log refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern (cgi-bin|\?) 0 0% 0 refresh_pattern . 0 20% 4320 icp_port 3130 coredump_dir /var/spool/squid *iptables configuration:* iptables -t mangle -N DIVERT iptables -t mangle -A DIVERT -j MARK --set-mark 1 iptables -t mangle -A DIVERT -j DROP iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 3129 ip rule add fwmark 1 lookup 100 ip route add local 0.0.0.0/0 dev lo table 100 *squid -v:* Squid Cache: Version 3.1.0.13 configure options: '--prefix=/usr' '--localstatedir=/var' '--libexecdir=/usr/lib/squid' '--srcdir=.' '--datadir=/usr/share/squid' '--sysconfdir=/etc/squid' '--with-default-user=proxy' '--with-logdir=/var/log' '--with-pidfile=/var/run/squid.pid' '--enable-linux-netfilter' --with-squid=/usr/src/squid-3.1.0.13 --enable-ltdl-convenience *network cenario:* pc => proxy/squid/tproxy => router *José Oliveira de Almeida Filho* Analista de Redes SERPRO/SUPRE/REPRO/RERCE *(** *+55 0XX 81 2126 4016 *** _jose.almeida-filho(a)serpro.gov.br_ Asif Bakali escreveu: > Gday > post your squid conf , iptables configuraion , squid -v compile > options and network senario > > > > On Fri, Aug 14, 2009 at 12:40 AM, Jose Oliveira de Almeida Filho > <jose.almeida-filho(a)serpro.gov.br > <mailto:jose.almeida-filho@serpro.gov.br>> wrote: > > Hi, > > I'm problems for caching squid. > > My situation is: > > The squid isn't writing in access.log, but the traffic is arriving > to destination with origin ip. > The squid isn't doing caching too. > > The cards are in mode bridge e the permissons are for user proxy > normally (+w). > When stop squid, the traffic stop too, indicanting that the > iptables transfer packets to squid (http_port 3129 tproxy) > > Att., > > -- > *José Oliveira de Almeida Filho* > Analista de Redes > SERPRO/SUPRE/REPRO/RERCE > *(** *+55 0XX 81 2126 4016 > *** _jose.almeida-filho(a)serpro.gov.br > <mailto:jose.almeida-filho@serpro.gov.br>_ > > "Esta mensagem do SERVIÇO FEDERAL DE PROCESSAMENTO DE DADOS (SERPRO), empresa pública federal regida pelo disposto na Lei Federal nº 5.615, é enviada exclusivamente a seu destinatário e pode conter informações confidenciais, protegidas por sigilo profissional. Sua utilização desautorizada é ilegal e sujeita o infrator às penas da lei. Se você a recebeu indevidamente, queira, por gentileza, reenviá-la ao emitente, esclarecendo o equívoco." > > "This message from SERVIÇO FEDERAL DE PROCESSAMENTO DE DADOS (SERPRO) -- a government company established under Brazilian law (5.615/70) -- is directed exclusively to its addressee and may contain confidential data, protected under professional secrecy rules. Its unauthorized use is illegal and may subject the transgressor to the law's penalties. If you're not the addressee, please send it back, elucidating the failure." > > > _______________________________________________ > tproxy mailing list > tproxy(a)lists.balabit.hu <mailto:tproxy@lists.balabit.hu> > https://lists.balabit.hu/mailman/listinfo/tproxy > > "Esta mensagem do SERVIÇO FEDERAL DE PROCESSAMENTO DE DADOS (SERPRO), empresa pública federal regida pelo disposto na Lei Federal nº 5.615, é enviada exclusivamente a seu destinatário e pode conter informações confidenciais, protegidas por sigilo profissional. Sua utilização desautorizada é ilegal e sujeita o infrator às penas da lei. Se você a recebeu indevidamente, queira, por gentileza, reenviá-la ao emitente, esclarecendo o equívoco." "This message from SERVIÇO FEDERAL DE PROCESSAMENTO DE DADOS (SERPRO) -- a government company established under Brazilian law (5.615/70) -- is directed exclusively to its addressee and may contain confidential data, protected under professional secrecy rules. Its unauthorized use is illegal and may subject the transgressor to the law's penalties. If you're not the addressee, please send it back, elucidating the failure."

1 0

Problems Caching
by Jose Oliveira de Almeida Filho 13 Aug '09

13 Aug '09

Hi, I'm problems for caching squid. My situation is: The squid isn't writing in access.log, but the traffic is arriving to destination with origin ip. The squid isn't doing caching too. The cards are in mode bridge e the permissons are for user proxy normally (+w). When stop squid, the traffic stop too, indicanting that the iptables transfer packets to squid (http_port 3129 tproxy) Att., -- *José Oliveira de Almeida Filho* Analista de Redes SERPRO/SUPRE/REPRO/RERCE *(** *+55 0XX 81 2126 4016 *** _jose.almeida-filho(a)serpro.gov.br_ "Esta mensagem do SERVIÇO FEDERAL DE PROCESSAMENTO DE DADOS (SERPRO), empresa pública federal regida pelo disposto na Lei Federal nº 5.615, é enviada exclusivamente a seu destinatário e pode conter informações confidenciais, protegidas por sigilo profissional. Sua utilização desautorizada é ilegal e sujeita o infrator às penas da lei. Se você a recebeu indevidamente, queira, por gentileza, reenviá-la ao emitente, esclarecendo o equívoco." "This message from SERVIÇO FEDERAL DE PROCESSAMENTO DE DADOS (SERPRO) -- a government company established under Brazilian law (5.615/70) -- is directed exclusively to its addressee and may contain confidential data, protected under professional secrecy rules. Its unauthorized use is illegal and may subject the transgressor to the law's penalties. If you're not the addressee, please send it back, elucidating the failure."

2 1

Problem with TPROXY and RAPIDSHARE
by Carlos Botejara 05 Aug '09

05 Aug '09

hi I have a problem, but first I describe the scenario I have clients with public IP Mikrotik router redirecting traffic to SQUID Squid 3.1 with support for TPROXY Iptables 1.4.4 with support for TPROXY Debian Lenny / Kernel 2.6.28 with support for TPROXY well. The proxy works as well, and when I made some test pages whatismyip, shows that the ip is the CLIENT. However. I can not get my clients with public IP address simultaneously downloading from RapidShare / Megaupload ETC. The error shown within these pages is the typical already are downloading from that ip, so if viewing RapidShare IP SQUID in reality and not the client. How fix this? the configuration file of squid in the harbor is well http_port 81 tproxy Iptables: iptables -t mangle -N DIVERT iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT iptables -t mangle -A DIVERT -j MARK --set-mark 1 iptables -t mangle -A DIVERT -j ACCEPT iptables -t mangle -A PREROUTING -p tcp --dport 3128 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 81 ip rule add fwmark 1 lookup 100 ip route add local 0.0.0.0/0 dev lo table 100 echo 1 > /proc/sys/net/ipv4/ip_forward Mikrotik: Have a rule in the firewall to redirect all traffic to port 80 of the SQUID to the IP, port 3128 All clients create sessions PPPOE in Router Mikrotik May help?

2 1

Configuration for multiple listening sockets, none of them on 'lo'
by Ashwani Wason 31 Jul '09

31 Jul '09

Hi All, I have a transparent proxy, which I want to listen on four VLAN interfaces on 2.6.30 kernel. Various reasons, but the proxy cannot listen on 'lo' or on INADDR_ANY. The interfaces are eth0.31 through eth0.34 and the proxy opens one listening socket per interface. All listening sockets are bound to the same port, 2345. I am trying to set up rules similar to what has been documented so far. This is what I have - the idea is to mark all packets identically (with mark 1) based on destination port 80 but using IP rules have them lookup a different routing table based on the incoming interface. The routing table would then deliver the packet to the corresponding physical interface. The problem is that the proxy never sees these connections (netstat –ant also does not show them, which means that IP is not delivering them). > "iptables -t mangle -N DIVERT" > "iptables -t mangle -A DIVERT -j MARK --set-mark 1" > "iptables -t mangle -A DIVERT -j ACCEPT" > "iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT" > "iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 2345" > > "ip rule add fwmark 1 iif eth0.31 lookup 101" > "ip route add local 0.0.0.0/0 dev eth0.31 table 101" > > "ip rule add fwmark 1 iif eth0.32 lookup 102" > "ip route add local 0.0.0.0/0 dev eth0.32 table 102" > > "ip rule add fwmark 1 iif eth0.33 lookup 103" > "ip route add local 0.0.0.0/0 dev eth0.33 table 103" > > "ip rule add fwmark 1 iif eth0.34 lookup 104" > "ip route add local 0.0.0.0/0 dev eth0.34 table 104" There is not much in the man page about the 'dev' argument of 'ip route add' other than that it is the output device name. Perhaps my interpretation is incorrect. The IP tables rules are working okay, as the "hit count" of pkts and bytes keeps going up in the output of 'iptables -t mangle -L -nv'. I am not sure what is happening thereafter. The packets are seemingly going into a black hole because 'netstat -sw' does not show them discarded, delivered, or forwarded. [root@]# netstat -sw Ip: 1859156 total packets received 0 forwarded 18 with unknown protocol 0 incoming packets discarded 3917 incoming packets delivered 2692 requests sent out Can you please help identify what is going on? If this has already been posted elsewhere then please let me know. Thanks, - Ashwani

2 2

Squid 3.1 + Tproxy 4.1 in Bridge Mode
by Tiago Resende 31 Jul '09

31 Jul '09

Hi, I tried to run squid 3.1 with tproxy in a bridge mode, but I just receive a Connection timed out. In access.log shows this entries: 1249010814.562 11319 187.0.xxx.xxx TCP_MISS/000 0 GET http://teklimbu.wordpress.com/2007/10/11/running-a-transparent-linux-squid-… DIRECT/ teklimbu.wordpress.com 1249010999.257 182407 187.0.xxx.xxx TCP_MISS/504 4146 GET http://teklimbu.wordpress.com/2007/10/11/running-a-transparent-linux-squid-… DIRECT/ 72.233.2.59 text/html These entries were transparently redirected to Squid, but after a long time the Squid returns a error page (110 connection timed out). I tried many ways, and nothing! The actual configuration is: eth0(Internet) eth1(intranet) br0 - bridge with eth0 and eth1 kernel 2.6.30.3 ebtables -t broute -A BROUTING -i eth0 -p ipv4 --ip-proto tcp --ip-dport 80 -j redirect --redirect-target DROP iptables -t mangle -N DIVERT iptables -t mangle -A DIVERT -j MARK --set-mark 1 iptables -t mangle -A DIVERT -j ACCEPT iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 3129 ip rule add fwmark 1 lookup 100 ip route add local 0.0.0.0/0 dev lo table 100 I already tried: cd /proc/sys/net/bridge for i in *; do echo 0 > $i; done Someone has an idea? Thanks, Tiago Resende

1 0

Tproxy NAT reservations.
by Saikiran Madugula 20 Jul '09

20 Jul '09

Is there some place I can find NAT reservations patch for 2.6.27 kernel ? I was able to find one for 2.6.17 kernel. Thanks, Kiran. Apologies if the mail is received more than once by the list. It did not show up in the Tproxy archives, so resend.

2 1

Backport to 2.6.24
by Harry Mason 13 Jul '09

13 Jul '09

Has anyone backported TPROXY to 2.6.24, the kernel used in Ubuntu Hardy? Any reason why it'd be difficult or impossible? -- Harry Mason Developer SmoothWall Limited 1 John Charles Way Leeds LS12 6QA United Kingdom 1 800 959 3760 (USA, Canada and North America) 0870 1 999 500 (United Kingdom) +44 870 1 999 500 (all other countries) SmoothWall is registered in England: 4298247 This email and any attachments transmitted with it are confidential to the intended recipient(s) and may not be communicated to any other person or published by any means without the permission of SmoothWall Limited. Any opinions stated in this message are solely those of the author. See: http://smoothwall.net/company/email.php for the full text of this notice.

3 2

Re: [tproxy] netcat for tproxy (and additional noob questions)
by KOVACS Krisztian 08 Jul '09

08 Jul '09

Hi, On Tue, Jul 07, 2009 at 07:49:17AM -0400, John Lauro wrote: > > I have a very simplistic patch for netcat here: > > > > http://home.sch.bme.hu/~piglet/netfilter/tproxy/netcat-ip_transparent- > > support.patch > > I think I came across that patch before. The problem is I can not find that > version (1.10) of netcat anywhere. Found some places that mention being > pointers to it, but dead links... It appears there a new GNU version that > has lower version number, and also a BSD version, but it is way different > too (or at least different enough that the patch doesn't apply). I think it was based on Debian netcat, so you could give the Debian version a try: ftp://ftp.debian.org/debian/pool/main/n/netcat/ > > Reusing the original port is usually a bad idea. A notable example of > > things breaking is Netfilter connection tracking, which gets confused > > if > > you reuse the exact same endpoints for a different connection. > > Technically they are not the exact same if you include the interface. If it > doesn't consider the interface then they would appear the same. Netfilter conntrack is interface agnostic -- and you're right that it's exactly that what's causing the problem here. -- KOVACS Krisztian

2 2