- tproxy - lists.balabit.hu

Re: [tproxy] tproxy Digest, Vol 47, Issue 9
by kudiejlq 31 May '09

31 May '09

that's seems your tproxy doesn't work yet.. 在2009-05-30?18:00:02，tproxy-request@lists.balabit.hu?写道： >Send?tproxy?mailing?list?submissions?to > tproxy(a)lists.balabit.hu > >To?subscribe?or?unsubscribe?via?the?World?Wide?Web,?visit > https://lists.balabit.hu/mailman/listinfo/tproxy >or,?via?email,?send?a?message?with?subject?or?body?'help'?to > tproxy-request(a)lists.balabit.hu > >You?can?reach?the?person?managing?the?list?at > tproxy-owner(a)lists.balabit.hu > >When?replying,?please?edit?your?Subject?line?so?it?is?more?specific >than?"Re:?Contents?of?tproxy?digest..." > > >Today's?Topics: > >???1.?Is?tproxy?a?real?transparent?proxy??(mtpr) > > >---------------------------------------------------------------------- > >Message:?1 >Date:?Fri,?29?May?2009?20:07:55?+0100 >From:?mtpr?<mtpr(a)carreira.com.pt> >Subject:?[tproxy]?Is?tproxy?a?real?transparent?proxy? >To:?tproxy@lists.balabit.hu >Message-ID:?<4A20328B.30304(a)carreira.com.pt> >Content-Type:?text/plain;?charset=ISO-8859-1;?format=flowed > >I?am?testing?tproxy?with?a?vmware?Centos-5.3?virtual?server. >I?installed?squid-3.1,?iptables-1.4.3?and?kernel-2.6.28.3. >Everything?seems?to?be?working,?unless?one... >There?is?a?proxy?behaviour?I?thought?it?would?be?expectable,?but?I?found? >it?doesn't?work?the?way?I?thought. > >Here?is?the?example: >If?I?create?a?cgi-bin?script?in?a?apache?webserver?that?prints?the? >client?ip?address?like?this?one: > >#!/bin/env?python >#?coding:?utf-8 >import?os > >print?'Content-Type:?text/plain' >print >print?os.environ['REMOTE_ADDR'] > >I?thought?that,?in?a?real?transparent?proxy,?it?would?give?me?the? >original?client?ip?address?of?the?browser?computer. >But?no! >Like?the?old?transparent?proxy?way?(not?tproxy),?it?prints?the?ip? >address?of?the?proxy?server. >If?I?want?the?original?ip?address,?I?need?to?read?the?environment? >variable?HTTP_X_FORWARDED_FOR. >It?doesn't?seem?to?be?a?"real"?transparent?proxy. > >Is?this?the?expectable?behaviour,?or?could?be?something?wrong?with?the? >way?I?setup?my?tproxy? > > >mtpr > > >------------------------------ > >_______________________________________________ >tproxy?mailing?list >tproxy(a)lists.balabit.hu >https://lists.balabit.hu/mailman/listinfo/tproxy > > >End?of?tproxy?Digest,?Vol?47,?Issue?9 >*************************************

1 0

Tproxy with WCCP configure error
by Engr.M.monzur Alam 13 May '09

13 May '09

I successfully configure tproxy all the steps. (Patching Centos, Patching iptables, Building squid). And also WCCP configuration with L4 WCCPv2. When I trying check gre0 tunnel with any packet flow but don't found any request. My error showed.............. [root@heldas]# tcpdump -i gre0 tcpdump: WARNING: arptype 778 not supported by libpcap - falling back to cooked socket tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on gre0, link-type LINUX_SLL (Linux cooked), capture size 96 bytes ^C 0 packets captured 0 packets received by filter 0 packets dropped by kernel My iptables script is........... #/bin/bash /sbin/iptables -t mangle -N DIVERT /sbin/iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT /sbin/iptables -t mangle -A DIVERT -j MARK --set-mark 1 /sbin/iptables -t mangle -A DIVERT -j ACCEPT /sbin/iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 3129 My Physical connectivity structure is .... Internet cloud to Cisco core router to Juniper firewall to Distributed Cisco router to Core Cisco switch to TPROXY Please give me a solution . Thanks Engr.Mohammad Monzur Alam Network & System Admin Grameen CyberNet Ltd. Dhaka, Bangladesh

2 2

tproxy bind failed - limit of TPROXY bind
by elyasaf 08 May '09

08 May '09

The tproxy bind is limit to only about 28219 socket I use TPROXY-4 (with the latest patch including latest udp patch too) Linux version 2.6.28.9 This is some sample test case: #define IP_TRANSPARENT 19 int main(){ int i,fd[100000],flag=1; struct sockaddr_in local_addr; bzero(&local_addr,sizeof(local_addr)); local_addr.sin_family = AF_INET; local_addr.sin_addr.s_addr=0xd0000000; for(i=0;i<100000;i++){ if((fd[i]=socket(AF_INET,SOCK_STREAM,0))<0){ printf("creating socket %d failed\n",i); exit(0); } if(setsockopt(fd[i],SOL_IP,IP_TRANSPARENT,&flag,sizeof(int))<0){ printf("set transparent to the %d socket (fd=%d) failed\n",i,fd[i]); exit(0); } local_addr.sin_port=0; if(bind(fd[i],(struct sockaddr *)&local_addr,sizeof(local_addr))<0){ perror("bind - error"); printf("bind for the %d socket (fd=%d) failed\nipport - %s:%d\n",i,fd[i],inet_ntoa(local_addr.sin_addr),htons(local_addr.sin_port)); exit(0); } local_addr.sin_addr.s_addr++; } } The result: bind - error: Address already in use bind for the 28223 socket (fd=28226) failed ipport - 63.110.0.208:0 Why this low limit? Can I configure something to by-pass it? If not, have chance to fix this bug?

3 6

Please give a solution
by Monzur Md.. Alam 08 May '09

08 May '09

Dear all, I have gone the the procedure as described at the following URL URL: http://wiki.squid-cache.org/Features/Tproxy4#head-f17bb712222beeb0aa083f022… I have successfully complied kernel:2.6.28.1 and iptables:1.4.3 with tproxy:2.6.25-20080519-165031-1211208631.tar.bz2 Now when I run following ipables commands, all the commands running without any problem except.... iptables 1.4.3 Configuration iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT and error messege shown: [root@hpproxy ~]# iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT iptables: No chain/target/match by that name. Run `dmesg' for more information. [root@hpproxy ~]# plese give me anybody solution..

2 1

Re: [tproxy] tproxy Digest, Vol 47, Issue 3
by Monzura Alam 06 May '09

06 May '09

Dear Amos, Thank you to your suggestion. We have a successfully patching tproxy-iptables and tproxy-kernel. Then how can i configured WCCP configuration in L4 WCCPv2 with GRE interface in my Linux box. It's also mention that we have used Centos 5.2 and Squid v3.1 Thanks Monzur ----- Original Message ----- From: <tproxy-request(a)lists.balabit.hu> To: <tproxy(a)lists.balabit.hu> Sent: Wednesday, May 06, 2009 4:00 PM Subject: tproxy Digest, Vol 47, Issue 3 > Send tproxy mailing list submissions to > tproxy(a)lists.balabit.hu > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.balabit.hu/mailman/listinfo/tproxy > or, via email, send a message with subject or body 'help' to > tproxy-request(a)lists.balabit.hu > > You can reach the person managing the list at > tproxy-owner(a)lists.balabit.hu > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of tproxy digest..." > > > Today's Topics: > > 1. Re: Please give a solution (sonu chouhan) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 5 May 2009 09:34:09 -0700 (PDT) > From: sonu chouhan <hi100nu(a)yahoo.com> > Subject: Re: [tproxy] Please give a solution > To: monzur(a)citechco.net > Cc: tproxy(a)lists.balabit.hu > Message-ID: <782120.52780.qm(a)web32508.mail.mud.yahoo.com> > Content-Type: text/plain; charset="iso-8859-1" > > it seem that?ur kernel is not compiled with netfilter socket support, > plz enable "CONFIG_NETFILTER_XT_MATCH_SOCKET=m" in your kernel's .config > file and again compile kernel > > > Bollywood news, movie reviews, film trailers and more! Go to > http://in.movies.yahoo.com/ >

1 0

Re: [tproxy] Please give a solution
by sonu chouhan 05 May '09

05 May '09

it seem that ur kernel is not compiled with netfilter socket support, plz enable "CONFIG_NETFILTER_XT_MATCH_SOCKET=m" in your kernel's .config file and again compile kernel Bollywood news, movie reviews, film trailers and more! Go to http://in.movies.yahoo.com/

1 0

Tproxy v4 patch for squid 2.7 version
by Visolve Squid Team 04 May '09

04 May '09

Hello all, Tproxy-4 patch for squid 2.7 STABLE6 is been released. Tproxy helps in IP spoofing, which means when a browser request for an URL, the client IP is sent to the webserver instead of the proxy server's IP. The patch is available at http://www.visolve.com/squid/squid-tproxy.php Thanks ViSolve Squid Team. http://www.visolve.com

4 6

file nor found......
by adnan 30 Apr '09

30 Apr '09

hello there, every one i am trying to di tproxy on the following spacified configuration .... kernel: linux-source-2.6.18 patch : cttproxy-2.6.18-2.0.6 iptables: iptables-1.4.3.2 it was fine all the way but at last when i go to install iptables- the following error occars -- please help... libipt_tproxy.c:8:47: warning: makelinux/netfilter_ipv4/ip_conntrack.h: No such file or directory please help.............. thanks

2 1

Re: [tproxy] iptables & iproute rules for tproxy v.4
by sonu chouhan 28 Apr '09

28 Apr '09

hi Kovacs, i am getting a strange problem. i am using kernel 2.6.28.2 with tproxy support, squid3.1.0.7 and iptables 1.4.3.2 and follow the method which explain in tproxy readme file, all is going ok but when i surf yahoo, hotmail and this type of other sites, when i login in mail it's stop responding and after long time it's give error message "zero size reply" or "server not responding" and it's never open but when i use normal transparent proxy it's work fine. and also work fine without proxy, i had try many thing and also use tcpdump but didn't get any solution, and with this setup i also didn't access my local webserver behind tproxy, but same here without tproxy i can access my local server smoothly, so please guide me to solve the problem. Thanks Nilesh... --- मंगल, 28/4/09 को, KOVACS Krisztian <hidden(a)sch.bme.hu> ने लिखा: द्वारा: KOVACS Krisztian <hidden(a)sch.bme.hu> विषय: Re: [tproxy] iptables & iproute rules for tproxy v.4 To: "sonu chouhan" <hi100nu(a)yahoo.com> Cc: tproxy(a)lists.balabit.hu दिनांक: मंगलवार, 28 अप्रैल, 2009, 5:20 PM Hi, On szo, ápr 25, 2009 at 03:10:14 -0700, sonu chouhan wrote: > can anybody give me there working iptables and iproute rules for tproxy v.4, You mean the one that got integrated in to 2.6.28 or the one you can download from Balabit (from http://www.balabit.hu/downloads/files/tproxy/obsolete/tproxy-4.0/)? For the former, the docs included in the kernel source should contain all you need: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=blob;f=D… For the latter I think the included readme file has all the info. -- KOVACS Krisztian Bollywood news, movie reviews, film trailers and more! Go to http://in.movies.yahoo.com/

1 0

iptables & iproute rules for tproxy v.4
by sonu chouhan 28 Apr '09

28 Apr '09

hi all, can anybody give me there working iptables and iproute rules for tproxy v.4, Thanks in advance. Nilesh.... Now surf faster and smarter ! Check out the new Firefox 3 - Yahoo! Edition http://downloads.yahoo.com/in/firefox/?fr=om_email_firefox

2 1