- tproxy - lists.balabit.hu

error comming --ip_tables: TPROXY target: invalid size 8 != 16
by Tanvir Adnan 23 Apr '09

23 Apr '09

hello everyone i am trying to configure my tproxy, i am using debian - kernel 2.6.18.6 and successfully patched the cttproxy-2.6.18-2.0.6. and iptables-1.4.3.1 successfully patched by tproxy-iptables-1.4.0-20080521-113954-1211362794.patch now i am going to add the following chain on my iptables-- iptables -t tproxy -A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j TPROXY --on-port 80 it is showing this following error--- iptables: Invalid argument. Run `dmesg' for more information. debproxy:~# dmesg ip_tables: TPROXY target: invalid size 8 != 16 ip_tables: TPROXY target: invalid size 8 != 16 Please let me know where is the problem and how to solve this. thanks and regards Adnan

2 1

IPv6 support
by Harry Mason 26 Mar '09

26 Mar '09

I'm interested in using TPROXY with IPv6, for transparent HTTP proxying and TRT. Before I start hacking: Is anyone already working on v6 support? Is there any fundamental reason why it isn't possible? Should I branch from Linus's tree, or is there more up to date TPROXY code I should use? Thanks Harry -- Harry Mason SmoothWall Ltd. - http://www.smoothwall.net/ SmoothWall Limited 1 John Charles Way Leeds LS12 6QA United Kingdom Phone: 1 800 959 3760 (USA, Canada and North America) 0870 1 999 500 (United Kingdom) +44 870 1 999 500 (all other countries) Fax: +44 870 1 991 399 SmoothWall Limited is registered in England, Company Number: 4298247 This email and any attachments transmitted with it are confidential to the intended recipient(s) and may not be communicated to any other person or published by any means without the permission of SmoothWall Limited. Any opinions stated in this message are solely those of the author. See: http://smoothwall.net/company/email.php for the full text of this notice.

2 1

squid TPROXY empty access.log
by Jack Daniels 24 Mar '09

24 Mar '09

Hello, I've a problem to log client request activities when Squid is in TPROXY mode. In squid.conf I have 'access_log /var/log/squid/access.log squid', this file is correctly created but results empty. # ls -la /var/log/squid/ -rw-r----- 1 proxy proxy 0 24 mar 16:09 access.log -rw-r----- 1 proxy proxy 413659 24 mar 16:09 cache.log -rw-r----- 1 proxy proxy 0 24 mar 16:09 referer.log -rw-r--r-- 1 root proxy 6 24 mar 16:09 squid.pid -rw-r----- 1 proxy proxy 0 24 mar 16:09 store.log If I remove 'tproxy' option from http_port in squid.conf it seems work but I lose the TPROXY Ip spoofing feature. Is this a bug? There is a way to log client request activities in tproxy mode? I need this feature to use Sarg in this environment. Thanks in advance. Here some details: # uname -r 2.6.28.8 # squid -v Squid Cache: Version 3.1.0.6 configure options: '--enable-linux-tproxy' '--enable-linux-netfilter' '--enable-ssl' '--with-openssl=/usr/include/openssl/' '--enable-err-languages=EnglisItalian' '--enable-default-err-language=Italian' '--disable-htcp' '--with-large-files' '--prefix=/usr' '--exec_prefix=/usr' '--bindir=/usr/sbin' '--sbindir=/usr/sbin' '--libdir=/usr/lib/squid' '--libexecdir=/usr/lib/squid' '--docdir=/usr/share/doc/squid' '--datarootdir=/usr/share/squid' '--datadir=/usr/share/squid' '--sysconfdir=/etc/squid' '--localstatedir=/var/spool/squid' '--mandir=/usr/share/man' '--with-logdir=/var/log/squid' '--enable-inline' '--enable-async-io=8' '--with-pthreads' '--enable-storeio=ufs,aufs,diskd' '--enable-removal-policies=lru,heap' '--enable-snmp' '--enable-delay-pools' '--enable-cache-digests' '--enable-underscores' '--enable-icap-client' '--enable-referer-log' '--enable-useragent-log' '--enable-follow-x-forwarded-for' '--enable-auth=basic,digest,ntlm' '--enable-basic-auth-helpers=NCSA' '--enable-digest-auth-helpers=password' '--enable-external-acl-helpers=ip_user,unix_group' '--with-filedescriptors=65536' '--with-default-user=proxy' --with-squid=/usr/src/squid-3.1.0.6 --enable-ltdl-convenience # iptables -V iptables v1.4.3-rc1 # iptables -t mangle -L Chain PREROUTING (policy ACCEPT) target prot opt source destination DIVERT tcp -- anywhere anywhere socket TPROXY tcp -- anywhere anywhere tcp dpt:www TPROXY redirect 0.0.0.0:3128 mark 0x1/0x1 Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain POSTROUTING (policy ACCEPT) target prot opt source destination Chain DIVERT (1 references) target prot opt source destination MARK all -- anywhere anywhere MARK xset 0x1/0xffffffff ACCEPT all -- anywhere anywhere # cat /etc/squid/squid.conf acl manager proto cache_object acl localhost src 127.0.0.1/32 acl to_localhost dst 127.0.0.0/8 acl localnet src 10.0.0.0/8 # RFC1918 possible internal network acl localnet src 172.16.0.0/12 # RFC1918 possible internal network acl localnet src 192.168.0.0/16 # RFC1918 possible internal network acl SSL_ports port 443 acl Safe_ports port 80 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 # https acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl CONNECT method CONNECT http_access allow manager localhost http_access deny manager http_access deny !Safe_ports http_access deny CONNECT !SSL_ports http_access allow localnet http_access deny all http_port 3128 tproxy #http_port 3128 transparent hierarchy_stoplist cgi-bin ? refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 refresh_pattern . 0 20% 4320 coredump_dir /var/spool/squid/cache cache_effective_user proxy cache_effective_group proxy access_log /var/log/squid/access.log squid cache_store_log /var/log/squid/store.log referer_log /var/log/squid/referer.log log_access allow all cache allow all # squid -X -d1 -N 2009/03/24 16:04:06.955| command-line -X overrides: ALL,7 2009/03/24 16:04:06.955| CacheManager::registerAction: registering legacy mem 2009/03/24 16:04:06.955| CacheManager::findAction: looking for action mem 2009/03/24 16:04:06.955| Action not found. 2009/03/24 16:04:06.955| CacheManager::registerAction: registered mem 2009/03/24 16:04:06.955| CacheManager::registerAction: registering legacy squidaio_counts 2009/03/24 16:04:06.955| CacheManager::findAction: looking for action squidaio_counts 2009/03/24 16:04:06.955| Action not found. 2009/03/24 16:04:06.955| CacheManager::registerAction: registered squidaio_counts 2009/03/24 16:04:06.955| CacheManager::registerAction: registering legacy diskd 2009/03/24 16:04:06.955| CacheManager::findAction: looking for action diskd 2009/03/24 16:04:06.955| Action not found. 2009/03/24 16:04:06.955| CacheManager::registerAction: registered diskd 2009/03/24 16:04:06.955| aclDestroyACLs: invoked 2009/03/24 16:04:06.955| ACL::Prototype::Registered: invoked for type src 2009/03/24 16:04:06.955| ACL::Prototype::Registered: yes 2009/03/24 16:04:06.955| ACL::FindByName 'all' 2009/03/24 16:04:06.955| ACL::FindByName found no match 2009/03/24 16:04:06.955| aclParseAclLine: Creating ACL 'all' 2009/03/24 16:04:06.955| ACL::Prototype::Factory: cloning an object for type 'src' 2009/03/24 16:04:06.955| aclIpParseIpData: all 2009/03/24 16:04:06.955| aclParseAccessLine: looking for ACL name 'all' 2009/03/24 16:04:06.955| ACL::FindByName 'all' 2009/03/24 16:04:06.955| Processing Configuration File: /etc/squid/squid.conf (depth 0) 2009/03/24 16:04:06.957| Processing: 'acl manager proto cache_object' 2009/03/24 16:04:06.957| ACL::Prototype::Registered: invoked for type proto 2009/03/24 16:04:06.957| ACL::Prototype::Registered: yes 2009/03/24 16:04:06.957| ACL::FindByName 'manager' 2009/03/24 16:04:06.957| ACL::FindByName found no match 2009/03/24 16:04:06.957| aclParseAclLine: Creating ACL 'manager' 2009/03/24 16:04:06.957| ACL::Prototype::Factory: cloning an object for type 'proto' 2009/03/24 16:04:06.957| Processing: 'acl localhost src 127.0.0.1/32' 2009/03/24 16:04:06.957| ACL::Prototype::Registered: invoked for type src 2009/03/24 16:04:06.957| ACL::Prototype::Registered: yes 2009/03/24 16:04:06.957| ACL::FindByName 'localhost' 2009/03/24 16:04:06.957| ACL::FindByName found no match 2009/03/24 16:04:06.957| aclParseAclLine: Creating ACL 'localhost' 2009/03/24 16:04:06.957| ACL::Prototype::Factory: cloning an object for type 'src' 2009/03/24 16:04:06.957| aclIpParseIpData: 127.0.0.1/32 2009/03/24 16:04:06.957| Processing: 'acl to_localhost dst 127.0.0.0/8' 2009/03/24 16:04:06.957| ACL::Prototype::Registered: invoked for type dst 2009/03/24 16:04:06.957| ACL::Prototype::Registered: yes 2009/03/24 16:04:06.957| ACL::FindByName 'to_localhost' 2009/03/24 16:04:06.957| ACL::FindByName found no match 2009/03/24 16:04:06.957| aclParseAclLine: Creating ACL 'to_localhost' 2009/03/24 16:04:06.957| ACL::Prototype::Factory: cloning an object for type 'dst' 2009/03/24 16:04:06.957| aclIpParseIpData: 127.0.0.0/8 2009/03/24 16:04:06.957| Processing: 'acl localnet src 10.0.0.0/8 # RFC1918 possible internal network' 2009/03/24 16:04:06.957| ACL::Prototype::Registered: invoked for type src 2009/03/24 16:04:06.957| ACL::Prototype::Registered: yes 2009/03/24 16:04:06.958| ACL::FindByName 'localnet' 2009/03/24 16:04:06.958| ACL::FindByName found no match 2009/03/24 16:04:06.958| aclParseAclLine: Creating ACL 'localnet' 2009/03/24 16:04:06.958| ACL::Prototype::Factory: cloning an object for type 'src' 2009/03/24 16:04:06.958| aclIpParseIpData: 10.0.0.0/8 2009/03/24 16:04:06.958| Processing: 'acl localnet src 172.16.0.0/12 # RFC1918 possible internal network' 2009/03/24 16:04:06.958| ACL::Prototype::Registered: invoked for type src 2009/03/24 16:04:06.958| ACL::Prototype::Registered: yes 2009/03/24 16:04:06.958| ACL::FindByName 'localnet' 2009/03/24 16:04:06.958| aclParseAclLine: Appending to 'localnet' 2009/03/24 16:04:06.958| aclIpParseIpData: 172.16.0.0/12 2009/03/24 16:04:06.958| aclIpAddrNetworkCompare: compare: 10.0.0.0/255.240.0.0 (10.0.0.0) vs 172.16.0.0-0.0.0.0/255.240.0.0 2009/03/24 16:04:06.958| aclIpAddrNetworkCompare: compare: 172.16.0.0/255.0.0.0 (172.0.0.0) vs 10.0.0.0-0.0.0.0/255.0.0.0 2009/03/24 16:04:06.958| Processing: 'acl localnet src 192.168.0.0/16 # RFC1918 possible internal network' 2009/03/24 16:04:06.958| ACL::Prototype::Registered: invoked for type src 2009/03/24 16:04:06.958| ACL::Prototype::Registered: yes 2009/03/24 16:04:06.958| ACL::FindByName 'localnet' 2009/03/24 16:04:06.958| aclParseAclLine: Appending to 'localnet' 2009/03/24 16:04:06.958| aclIpParseIpData: 192.168.0.0/16 2009/03/24 16:04:06.958| aclIpAddrNetworkCompare: compare: 172.16.0.0/255.255.0.0 (172.16.0.0) vs 192.168.0.0-0.0.0.0/255.255.0.0 2009/03/24 16:04:06.958| aclIpAddrNetworkCompare: compare: 192.168.0.0/255.240.0.0 (192.160.0.0) vs 172.16.0.0-0.0.0.0/255.240.0.0 2009/03/24 16:04:06.958| Processing: 'acl SSL_ports port 443' 2009/03/24 16:04:06.958| ACL::Prototype::Registered: invoked for type port 2009/03/24 16:04:06.958| ACL::Prototype::Registered: yes 2009/03/24 16:04:06.958| ACL::FindByName 'SSL_ports' 2009/03/24 16:04:06.958| ACL::FindByName found no match 2009/03/24 16:04:06.958| aclParseAclLine: Creating ACL 'SSL_ports' 2009/03/24 16:04:06.958| ACL::Prototype::Factory: cloning an object for type 'port' 2009/03/24 16:04:06.958| Processing: 'acl Safe_ports port 80 # http' 2009/03/24 16:04:06.958| ACL::Prototype::Registered: invoked for type port 2009/03/24 16:04:06.958| ACL::Prototype::Registered: yes 2009/03/24 16:04:06.958| ACL::FindByName 'Safe_ports' 2009/03/24 16:04:06.958| ACL::FindByName found no match 2009/03/24 16:04:06.958| aclParseAclLine: Creating ACL 'Safe_ports' 2009/03/24 16:04:06.958| ACL::Prototype::Factory: cloning an object for type 'port' 2009/03/24 16:04:06.958| Processing: 'acl Safe_ports port 21 # ftp' 2009/03/24 16:04:06.958| ACL::Prototype::Registered: invoked for type port 2009/03/24 16:04:06.958| ACL::Prototype::Registered: yes 2009/03/24 16:04:06.958| ACL::FindByName 'Safe_ports' 2009/03/24 16:04:06.958| aclParseAclLine: Appending to 'Safe_ports' 2009/03/24 16:04:06.958| Processing: 'acl Safe_ports port 443 # https' 2009/03/24 16:04:06.958| ACL::Prototype::Registered: invoked for type port 2009/03/24 16:04:06.958| ACL::Prototype::Registered: yes 2009/03/24 16:04:06.958| ACL::FindByName 'Safe_ports' 2009/03/24 16:04:06.958| aclParseAclLine: Appending to 'Safe_ports' 2009/03/24 16:04:06.959| Processing: 'acl Safe_ports port 70 # gopher' 2009/03/24 16:04:06.959| ACL::Prototype::Registered: invoked for type port 2009/03/24 16:04:06.959| ACL::Prototype::Registered: yes 2009/03/24 16:04:06.959| ACL::FindByName 'Safe_ports' 2009/03/24 16:04:06.959| aclParseAclLine: Appending to 'Safe_ports' 2009/03/24 16:04:06.959| Processing: 'acl Safe_ports port 210 # wais' 2009/03/24 16:04:06.959| ACL::Prototype::Registered: invoked for type port 2009/03/24 16:04:06.959| ACL::Prototype::Registered: yes 2009/03/24 16:04:06.959| ACL::FindByName 'Safe_ports' 2009/03/24 16:04:06.959| aclParseAclLine: Appending to 'Safe_ports' 2009/03/24 16:04:06.959| Processing: 'acl Safe_ports port 1025-65535 # unregistered ports' 2009/03/24 16:04:06.959| ACL::Prototype::Registered: invoked for type port 2009/03/24 16:04:06.959| ACL::Prototype::Registered: yes 2009/03/24 16:04:06.959| ACL::FindByName 'Safe_ports' 2009/03/24 16:04:06.959| aclParseAclLine: Appending to 'Safe_ports' 2009/03/24 16:04:06.959| Processing: 'acl Safe_ports port 280 # http-mgmt' 2009/03/24 16:04:06.959| ACL::Prototype::Registered: invoked for type port 2009/03/24 16:04:06.959| ACL::Prototype::Registered: yes 2009/03/24 16:04:06.959| ACL::FindByName 'Safe_ports' 2009/03/24 16:04:06.959| aclParseAclLine: Appending to 'Safe_ports' 2009/03/24 16:04:06.959| Processing: 'acl Safe_ports port 488 # gss-http' 2009/03/24 16:04:06.959| ACL::Prototype::Registered: invoked for type port 2009/03/24 16:04:06.959| ACL::Prototype::Registered: yes 2009/03/24 16:04:06.959| ACL::FindByName 'Safe_ports' 2009/03/24 16:04:06.959| aclParseAclLine: Appending to 'Safe_ports' 2009/03/24 16:04:06.959| Processing: 'acl Safe_ports port 591 # filemaker' 2009/03/24 16:04:06.959| ACL::Prototype::Registered: invoked for type port 2009/03/24 16:04:06.959| ACL::Prototype::Registered: yes 2009/03/24 16:04:06.959| ACL::FindByName 'Safe_ports' 2009/03/24 16:04:06.959| aclParseAclLine: Appending to 'Safe_ports' 2009/03/24 16:04:06.959| Processing: 'acl Safe_ports port 777 # multiling http' 2009/03/24 16:04:06.959| ACL::Prototype::Registered: invoked for type port 2009/03/24 16:04:06.959| ACL::Prototype::Registered: yes 2009/03/24 16:04:06.959| ACL::FindByName 'Safe_ports' 2009/03/24 16:04:06.959| aclParseAclLine: Appending to 'Safe_ports' 2009/03/24 16:04:06.959| Processing: 'acl CONNECT method CONNECT' 2009/03/24 16:04:06.959| ACL::Prototype::Registered: invoked for type method 2009/03/24 16:04:06.959| ACL::Prototype::Registered: yes 2009/03/24 16:04:06.959| ACL::FindByName 'CONNECT' 2009/03/24 16:04:06.959| ACL::FindByName found no match 2009/03/24 16:04:06.959| aclParseAclLine: Creating ACL 'CONNECT' 2009/03/24 16:04:06.959| ACL::Prototype::Factory: cloning an object for type 'method' 2009/03/24 16:04:06.959| Processing: 'http_access allow manager localhost' 2009/03/24 16:04:06.959| aclParseAccessLine: looking for ACL name 'manager' 2009/03/24 16:04:06.959| ACL::FindByName 'manager' 2009/03/24 16:04:06.959| aclParseAccessLine: looking for ACL name 'localhost' 2009/03/24 16:04:06.959| ACL::FindByName 'localhost' 2009/03/24 16:04:06.959| Processing: 'http_access deny manager' 2009/03/24 16:04:06.959| aclParseAccessLine: looking for ACL name 'manager' 2009/03/24 16:04:06.959| ACL::FindByName 'manager' 2009/03/24 16:04:06.959| Processing: 'http_access deny !Safe_ports' 2009/03/24 16:04:06.959| aclParseAccessLine: looking for ACL name 'Safe_ports' 2009/03/24 16:04:06.960| ACL::FindByName 'Safe_ports' 2009/03/24 16:04:06.960| Processing: 'http_access deny CONNECT !SSL_ports' 2009/03/24 16:04:06.960| aclParseAccessLine: looking for ACL name 'CONNECT' 2009/03/24 16:04:06.960| ACL::FindByName 'CONNECT' 2009/03/24 16:04:06.960| aclParseAccessLine: looking for ACL name 'SSL_ports' 2009/03/24 16:04:06.960| ACL::FindByName 'SSL_ports' 2009/03/24 16:04:06.960| Processing: 'http_access allow localnet' 2009/03/24 16:04:06.960| aclParseAccessLine: looking for ACL name 'localnet' 2009/03/24 16:04:06.960| ACL::FindByName 'localnet' 2009/03/24 16:04:06.960| Processing: 'http_access deny all' 2009/03/24 16:04:06.960| aclParseAccessLine: looking for ACL name 'all' 2009/03/24 16:04:06.960| ACL::FindByName 'all' 2009/03/24 16:04:06.960| Processing: 'http_port 3128 tproxy' 2009/03/24 16:04:06.960| http(s)_port: found Listen on Port: 3128 2009/03/24 16:04:06.960| http(s)_port: found Listen on wildcard address: 0.0.0.0:3128 2009/03/24 16:04:06.960| Starting IP Spoofing on port 0.0.0.0:3128 2009/03/24 16:04:06.960| Disabling Authentication on port 0.0.0.0:3128 (Ip spoofing enabled) 2009/03/24 16:04:06.960| Processing: 'hierarchy_stoplist cgi-bin ?' 2009/03/24 16:04:06.960| Processing: 'refresh_pattern ^ftp: 1440 20% 10080' 2009/03/24 16:04:06.960| Processing: 'refresh_pattern ^gopher: 1440 0% 1440' 2009/03/24 16:04:06.960| Processing: 'refresh_pattern -i (/cgi-bin/|\?) 0 0% 0' 2009/03/24 16:04:06.960| Processing: 'refresh_pattern . 0 20% 4320' 2009/03/24 16:04:06.960| Processing: 'coredump_dir /var/spool/squid/cache' 2009/03/24 16:04:06.960| Processing: 'cache_effective_user proxy' 2009/03/24 16:04:06.960| Processing: 'cache_effective_group proxy' 2009/03/24 16:04:06.960| Processing: 'access_log /var/log/squid/access.log squid' 2009/03/24 16:04:06.960| Log definition name 'squid' file '/var/log/squid/access.log' 2009/03/24 16:04:06.960| Processing: 'cache_store_log /var/log/squid/store.log' 2009/03/24 16:04:06.960| Processing: 'referer_log /var/log/squid/referer.log' 2009/03/24 16:04:06.960| Processing: 'log_access allow all' 2009/03/24 16:04:06.960| aclParseAccessLine: looking for ACL name 'all' 2009/03/24 16:04:06.960| ACL::FindByName 'all' 2009/03/24 16:04:06.960| Processing: 'cache allow all ' 2009/03/24 16:04:06.961| aclParseAccessLine: looking for ACL name 'all' 2009/03/24 16:04:06.961| ACL::FindByName 'all' 2009/03/24 16:04:06.961| aclParseAccessLine: looking for ACL name 'all' 2009/03/24 16:04:06.961| ACL::FindByName 'all' 2009/03/24 16:04:06.961| aclParseAccessLine: looking for ACL name 'all' 2009/03/24 16:04:06.961| ACL::FindByName 'all' 2009/03/24 16:04:06.961| aclParseAccessLine: looking for ACL name 'all' 2009/03/24 16:04:06.961| ACL::FindByName 'all' 2009/03/24 16:04:06.961| aclParseAccessLine: looking for ACL name 'all' 2009/03/24 16:04:06.961| ACL::FindByName 'all' 2009/03/24 16:04:06.961| aclParseAccessLine: looking for ACL name 'all' 2009/03/24 16:04:06.961| ACL::FindByName 'all' 2009/03/24 16:04:06.961| wccp2_add_service_list: added service id 0 2009/03/24 16:04:06.961| aclParseAccessLine: looking for ACL name 'all' 2009/03/24 16:04:06.961| ACL::FindByName 'all' 2009/03/24 16:04:06.961| tools.cc(671) uniqueHostname: Config: ' 2009/03/24 16:04:06.961| getMyHostname: 'netflow' has rDNS. 2009/03/24 16:04:06.961| tools.cc(671) uniqueHostname: Config: ' 2009/03/24 16:04:06.961| acl_access::containsPURGE: invoked for 'http_access allow manager localhost' 2009/03/24 16:04:06.961| acl_access::containsPURGE: can't create tempAcl 2009/03/24 16:04:06.961| acl_access::containsPURGE: can't create tempAcl 2009/03/24 16:04:06.961| acl_access::containsPURGE: can't create tempAcl 2009/03/24 16:04:06.961| acl_access::containsPURGE: can't create tempAcl 2009/03/24 16:04:06.961| acl_access::containsPURGE: can't create tempAcl 2009/03/24 16:04:06.961| acl_access::containsPURGE: can't create tempAcl 2009/03/24 16:04:06.961| acl_access::containsPURGE: can't create tempAcl 2009/03/24 16:04:06.961| acl_access::containsPURGE: returning false 2009/03/24 16:04:06.961| Initializing https proxy context 2009/03/24 16:04:06.964| Using SSLv2/SSLv3. 2009/03/24 16:04:06.965| Setting RSA key generation callback. 2009/03/24 16:04:06.965| Setting certificate verification callback. 2009/03/24 16:04:06.965| Setting CA certificate locations. 2009/03/24 16:04:06.965| leave_suid: PID 11891 called 2009/03/24 16:04:06.965| leave_suid: PID 11891 giving up root, becoming 'proxy' 2009/03/24 16:04:06.965| Stopping full transparency: Missing needed capability support. 2009/03/24 16:04:06.965| command-line -X overrides: ALL,1 2009/03/24 16:04:06.966| Starting Squid Cache version 3.1.0.6 for i686-pc-linux-gnu... 2009/03/24 16:04:06.966| Process ID 11891 2009/03/24 16:04:06.966| With 1024 file descriptors available 2009/03/24 16:04:06.966| Initializing IP Cache... 2009/03/24 16:04:06.966| ipcacheAddEntryFromHosts: Bad IP address '::1' 2009/03/24 16:04:06.966| ipcacheAddEntryFromHosts: Bad IP address 'fe00::0' 2009/03/24 16:04:06.967| ipcacheAddEntryFromHosts: Bad IP address 'ff00::0' 2009/03/24 16:04:06.967| ipcacheAddEntryFromHosts: Bad IP address 'ff02::1' 2009/03/24 16:04:06.967| ipcacheAddEntryFromHosts: Bad IP address 'ff02::2' 2009/03/24 16:04:06.967| ipcacheAddEntryFromHosts: Bad IP address 'ff02::3' 2009/03/24 16:04:06.967| DNS Socket created at 0.0.0.0, FD 5 2009/03/24 16:04:06.967| Adding domain isiline.net from /etc/resolv.conf 2009/03/24 16:04:06.967| Adding nameserver 213.144.64.1 from /etc/resolv.conf 2009/03/24 16:04:06.967| Adding nameserver 213.144.66.1 from /etc/resolv.conf 2009/03/24 16:04:06.968| User-Agent logging is disabled. 2009/03/24 16:04:07.234| Unlinkd pipe opened on FD 11 2009/03/24 16:04:07.238| Local cache digest enabled; rebuild/rewrite every 3600/3600 sec 2009/03/24 16:04:07.238| Swap maxSize 0 KB, estimated 0 objects 2009/03/24 16:04:07.238| Target number of buckets: 0 2009/03/24 16:04:07.238| Using 8192 Store buckets 2009/03/24 16:04:07.238| Max Mem size: 262144 KB 2009/03/24 16:04:07.238| Max Swap size: 0 KB 2009/03/24 16:04:07.238| Using Least Load store dir selection 2009/03/24 16:04:07.239| Set Current Directory to /var/spool/squid/cache 2009/03/24 16:04:07.335| Loaded Icons. 2009/03/24 16:04:07.336| Accepting spoofing HTTP connections at 0.0.0.0:3128, FD 13. 2009/03/24 16:04:07.336| HTCP Disabled. 2009/03/24 16:04:07.337| Squid modules loaded: 0 2009/03/24 16:04:07.337| Adaptation support is off. 2009/03/24 16:04:07.337| Ready to serve requests.

1 0

Re: [tproxy] TProxy4 and Squid 3.1.0.5 client address spoofing problem !
by Hamid Hashemi 22 Mar '09

22 Mar '09

Dear Modestas, Thanks for your response. My problem was exactly the libcap-devel ( CentOS package name ) missing in compile time. unfortunately there was no error or warning message in configure time in compile and if you rely in the messages in configure or compile time it should work. I was following up this howto : http://wiki.squid-cache.org/ConfigExamples/TPROXYPatchingCentOS and there was no hint about this package. Anyway the problem was solved compeletely and I think it is better to mention this in squid-cache.org HOWTO. _Hamid On Sat, Mar 14, 2009 at 6:04 PM, Modestas Vainius <modestas(a)vainius.eu>wrote: > Hello, > > I faced similar problem to yours yesterday. > > Linux 2.6.28 on Debian GNU/Linux amd64 (TPROXY v4.1) > iptables 1.4.3 snapshot (20090312) > squid 3.1.0.6 (beta) > > I had no problems building iptables 1.4.3 snapshot, TPROXY target was built > properly without a hassle and worked perfectly out-of-the-box. > > Squid seemed to build fine from the first sight however it simply didn't do > any tproxy'ing (tproxy port worked but packets came out with the IP of the > squid server). After long hours of debugging and tracing, I localized the > problem to this squid code at src/tools.cc [1]. > > And guess what: > > # squid -X 2>&1 | grep 'Stopping full transparency' > Stopping full transparency: Missing needed capability support. > > So I needed to install libcap-dev package (on Debian) and to get > development > headers (sys/capability.h) for the Linux capabilities library and rebuild > squid. And squid has started working fine then. I guess you have the same > issue, just package name is different. > > Basically, I recommend running the command above to check your squid config > with regard to tproxy support. Obviously, it should return nothing if > transparency support has been successfully enabled. squid should be more > verbose about such errors... > > What is more, TPROXY+squid works fine on my router/server which does > NETMAP/SNAT too (I was concerned that there would be problems with > nat'ing). > Great job and thanks to everybody involved. > > 1. > ------------------- > static void > restoreCapabilities(int keep) > { > /* NP: keep these two if-endif separate. Non-Linux work perfectly well > without Linux syscap support. */ > #if defined(_SQUID_LINUX_) > > #if HAVE_SYS_CAPABILITY_H > #ifndef _LINUX_CAPABILITY_VERSION_1 > #define _LINUX_CAPABILITY_VERSION_1 _LINUX_CAPABILITY_VERSION > #endif > cap_user_header_t head = (cap_user_header_t) xcalloc(1, sizeof(*head)); > cap_user_data_t cap = (cap_user_data_t) xcalloc(1, sizeof(*cap)); > > head->version = _LINUX_CAPABILITY_VERSION_1; > > if (capget(head, cap) != 0) { > debugs(50, DBG_IMPORTANT, "Can't get current capabilities"); > } else if (head->version != _LINUX_CAPABILITY_VERSION_1) { > debugs(50, DBG_IMPORTANT, "Invalid capability version " << head- > >version << " (expected " << _LINUX_CAPABILITY_VERSION_1 << ")"); > } else { > > head->pid = 0; > > cap->inheritable = 0; > cap->effective = (1 << CAP_NET_BIND_SERVICE); > > if (IpInterceptor.TransparentActive()) { > cap->effective |= (1 << CAP_NET_ADMIN); > #if LINUX_TPROXY2 > cap->effective |= (1 << CAP_NET_BROADCAST); > #endif > } > > if (!keep) > cap->permitted &= cap->effective; > > if (capset(head, cap) != 0) { > IpInterceptor.StopTransparency("Error enabling needed > capabilities."); > } > } > > xfree(head); > xfree(cap); > > #else > IpInterceptor.StopTransparency("Missing needed capability support."); > #endif /* HAVE_SYS_CAPABILITY_H */ > > #endif /* !defined(_SQUID_LINUX_) */ > } > --------------- > > -- > Modestas Vainius <modestas(a)vainius.eu> > > -- Regards Hamid Hashemi

1 0

Problem with redirection from 80 to 8080 with -j TPROXY redirect
by Pranav Desai 15 Mar '09

15 Mar '09

Hello All, I am having some trouble redirecting port 80 traffic to 8080 using tproxy for transparent proxying. The SYNs come in but there is no SYN-ACK going out. the iptables -L do show the rules being matched. tcpdump output -------------------- # tcpdump -nn -i eth1 port 8080 or port 80 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth1, link-type EN10MB (Ethernet), capture size 96 bytes 12:12:30.973583 IP 13.1.1.1.34879 > 172.16.55.205.80: S 2941026950:2941026950(0) win 5840 <mss 1460,sackOK,timestamp 3948186312 0,nop,wscale 7> 12:12:33.974329 IP 13.1.1.1.34879 > 172.16.55.205.80: S 2941026950:2941026950(0) win 5840 <mss 1460,sackOK,timestamp 3948189312 0,nop,wscale 7> Kernel (with tproxy enabled) and Iptables Version -------------------------------------------------------------- # iptables -V iptables v1.4.3-rc1 # uname -a Linux dev 2.6.28.3 #1 SMP Sun Mar 1 23:13:20 PST 2009 x86_64 x86_64 x86_64 GNU/Linux I am only trying to get the first step of redirection working. Are these instructions in the README enough, or do I need any thing else ? <instructions> iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --on-port <proxyport> --tproxy-mark 0x1/0x1 ip rule add fwmark 1 lookup 100 ip route add local 0.0.0.0/0 dev lo table 100 </instructions> I do have 2 interfaces, does that have anything to do with the problem ? I have even tried with the other mangle rules (the rules for socket match) given in the README, but still no difference. I have given some details below, but let me know if you need any other details. Thanks -- Pranav mangle table (nat and filter table are empty) -------------------------------------------------------- Chain PREROUTING (policy ACCEPT 31132 packets, 2279K bytes) pkts bytes target prot opt in out source destination 3 180 TPROXY tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 TPROXY redirect 0.0.0.0:8080 mark 0x1/0x1 Chain INPUT (policy ACCEPT 33779 packets, 2304K bytes) pkts bytes target prot opt in out source destination Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 36335 packets, 35M bytes) pkts bytes target prot opt in out source destination Chain POSTROUTING (policy ACCEPT 36355 packets, 35M bytes) pkts bytes target prot opt in out source destination Chain DIVERT (0 references) pkts bytes target prot opt in out source destination Here are my ip rule and route setting --------------------------------------------- # ip rule ls 0: from all lookup 255 32765: from all fwmark 0x1 lookup 100 32766: from all lookup main 32767: from all lookup default # ip route ls table 100 local default dev lo scope host Here are my modules. --------------------------- # lsmod | egrep "xt|nf" [root@vcadev httpd]# ip rule ls xt_TPROXY 2944 1 xt_socket 3264 0 nf_tproxy_core 3200 2 xt_TPROXY,xt_socket,[permanent] xt_MARK 3456 0 nf_nat 18580 2 ipt_REDIRECT,iptable_nat nf_conntrack_ipv4 14680 3 iptable_nat,nf_nat nf_conntrack 58984 4 xt_socket,iptable_nat,nf_nat,nf_conntrack_ipv4 nf_defrag_ipv4 2560 3 xt_TPROXY,xt_socket,nf_conntrack_ipv4

2 1

Re: [tproxy] Problem with redirection from 80 to 8080 with -j TPROXY redirect [SOLVED]
by Pranav Desai 05 Mar '09

05 Mar '09

Hello All, Even the listen socket needs to have to setsockopt(IP_TRANSPARENT). I missed that, I was doing it only for the backend connecting socket. Thanks -- Pranav On Mon, Mar 2, 2009 at 12:16 PM, Pranav Desai <pranavadesai(a)gmail.com> wrote: > Hello All, > > I am having some trouble redirecting port 80 traffic to 8080 using > tproxy for transparent proxying. > The SYNs come in but there is no SYN-ACK going out. the iptables -L do > show the rules being matched. > > tcpdump output > -------------------- > # tcpdump -nn -i eth1 port 8080 or port 80 > tcpdump: verbose output suppressed, use -v or -vv for full protocol decode > listening on eth1, link-type EN10MB (Ethernet), capture size 96 bytes > > 12:12:30.973583 IP 13.1.1.1.34879 > 172.16.55.205.80: S > 2941026950:2941026950(0) win 5840 <mss 1460,sackOK,timestamp > 3948186312 0,nop,wscale 7> > 12:12:33.974329 IP 13.1.1.1.34879 > 172.16.55.205.80: S > 2941026950:2941026950(0) win 5840 <mss 1460,sackOK,timestamp > 3948189312 0,nop,wscale 7> > > Kernel (with tproxy enabled) and Iptables Version > -------------------------------------------------------------- > # iptables -V > iptables v1.4.3-rc1 > # uname -a > Linux dev 2.6.28.3 #1 SMP Sun Mar 1 23:13:20 PST 2009 x86_64 x86_64 > x86_64 GNU/Linux > > > I am only trying to get the first step of redirection working. > > Are these instructions in the README enough, or do I need any thing else ? > <instructions> > iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY > --on-port <proxyport> --tproxy-mark 0x1/0x1 > > ip rule add fwmark 1 lookup 100 > ip route add local 0.0.0.0/0 dev lo table 100 > </instructions> > > I do have 2 interfaces, does that have anything to do with the problem ? > > I have even tried with the other mangle rules (the rules for socket > match) given in the README, but still no difference. I have given some > details below, but let me know if you need any other details. > > Thanks > -- Pranav > > > mangle table (nat and filter table are empty) > -------------------------------------------------------- > Chain PREROUTING (policy ACCEPT 31132 packets, 2279K bytes) > pkts bytes target prot opt in out source > destination > 3 180 TPROXY tcp -- * * 0.0.0.0/0 > 0.0.0.0/0 tcp dpt:80 TPROXY redirect 0.0.0.0:8080 mark > 0x1/0x1 > > Chain INPUT (policy ACCEPT 33779 packets, 2304K bytes) > pkts bytes target prot opt in out source > destination > > Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) > pkts bytes target prot opt in out source > destination > > Chain OUTPUT (policy ACCEPT 36335 packets, 35M bytes) > pkts bytes target prot opt in out source > destination > > Chain POSTROUTING (policy ACCEPT 36355 packets, 35M bytes) > pkts bytes target prot opt in out source > destination > > Chain DIVERT (0 references) > pkts bytes target prot opt in out source > destination > > > Here are my ip rule and route setting > --------------------------------------------- > # ip rule ls > 0: from all lookup 255 > 32765: from all fwmark 0x1 lookup 100 > 32766: from all lookup main > 32767: from all lookup default > > # ip route ls table 100 > local default dev lo scope host > > > Here are my modules. > --------------------------- > # lsmod | egrep "xt|nf" > [root@vcadev httpd]# ip rule ls > xt_TPROXY 2944 1 > xt_socket 3264 0 > nf_tproxy_core 3200 2 xt_TPROXY,xt_socket,[permanent] > xt_MARK 3456 0 > nf_nat 18580 2 ipt_REDIRECT,iptable_nat > nf_conntrack_ipv4 14680 3 iptable_nat,nf_nat > nf_conntrack 58984 4 xt_socket,iptable_nat,nf_nat,nf_conntrack_ipv4 > nf_defrag_ipv4 2560 3 xt_TPROXY,xt_socket,nf_conntrack_ipv4 >

2 1

tproxy4 + cacheboy (lusca) .. non gateway
by Alexandre Correa 18 Feb '09

18 Feb '09

Hails !!! tproxy4 works when squid are not gateway of clients ? gateway "DNATing" to proxy server ... -- Sds. Alexandre J. Correa Onda Internet / OPinguim.net http://www.ondainternet.com.br http://www.opinguim.net

2 1

TProxy4 and Squid 3.1.0.5 client address spoofing problem !
by Hamid Hashemi 17 Feb '09

17 Feb '09

Hi, Here is my situation : - CentOS 5.2 ( my own built kernel 2.6.25.11-TProxy-ReiserFS with this patch : http://www.balabit.com/downloads/files/tproxy/tproxy-kernel-2.6.25-20080519… ) - iptables v1.4.3-rc1( ftp://ftp.netfilter.org/pub/iptables/snapshot/iptables-20090206.tar.bz2 ) - squid 3.1.0.5 RC ( http://www.squid-cache.org/Versions/v3/3.1/squid-3.1.0.5.tar.bz2 ) and compiled with these options : "'--enable-poll' '--enable-storeio=aufs,diskd,ufs' '--with-pthreads' '--enable-removal-policies=heap,lru' '--enable- linux-netfilter' '--enable-useragent-log' '--enable-referer-log' '--enable-underscores' '--disable-dependency-tracking' '--disable-ident-lookups' '--with-large-files' '--enable-follow-x-forwarded-for' '--enable-cache-digests' '--enable-delay-pools' '--enable-truncate' '--prefix=/usr' '--localstatedir=/var' '--sysconfdir=/etc/squid' '--with-logdir=/var/log/squid' '--enable-wccpv2' '--enable-wccp' '--exec_prefix=/usr' '--bindir=/usr/sbin' '--libexecdir=/usr/lib/squid' '--with-filedescriptors=8192' --with-squid=/usr/src/squid-3.1.0.5 --enable-ltdl-convenience\" - with following iptables rules : [root@CACHE1 squid-3.1.0.5]# service iptables status Table: filter Chain INPUT (policy ACCEPT) num target prot opt source destination Chain FORWARD (policy ACCEPT) num target prot opt source destination Chain OUTPUT (policy ACCEPT) num target prot opt source destination Table: mangle Chain PREROUTING (policy ACCEPT) num target prot opt source destination 1 DIVERT tcp -- 0.0.0.0/0 0.0.0.0/0 socket 2 TPROXY tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 TPROXY redirect 0.0.0.0:3129 mark 0x1/0x1 Chain INPUT (policy ACCEPT) num target prot opt source destination Chain FORWARD (policy ACCEPT) num target prot opt source destination Chain OUTPUT (policy ACCEPT) num target prot opt source destination Chain POSTROUTING (policy ACCEPT) num target prot opt source destination Chain DIVERT (1 references) num target prot opt source destination 1 MARK all -- 0.0.0.0/0 0.0.0.0/0 MARK xset 0x1/0xffffffff 2 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 [root@CACHE1 squid-3.1.0.5]# - With following iproute2 rules : [root@CACHE1 squid-3.1.0.5]# ip ru list 0: from all lookup 255 32765: from all fwmark 0x1 lookup 100 32766: from all lookup main 32767: from all lookup default [root@CACHE1 squid-3.1.0.5]# ip ro list table 100 local default dev lo scope host [root@CACHE1 squid-3.1.0.5]# - with following http_port line in squid : http_port 3129 tproxy everything seems to be working and squid run with these messages in cache.log : 2009/02/07 22:22:43| Accepting spoofing HTTP connections at 0.0.0.0:3129, FD 16. my requests seems to be redirected to port 3129 as I expected and the pages are loading propertly. But the problem is that when I go to site http://myipaddress.co.uk/ it gives me the cache ip address instead of my own client ip address. here is the tethereal output for one of my requests : [root@CACHE1 squid-3.1.0.5]# tethereal host 85.247.162.18 -n Running as user "root" and group "root". This could be dangerous. Capturing on eth1 0.000000 85.247.162.18 -> 213.171.218.15 TCP 57226 > 80 [SYN] Seq=0 Win=5840 Len=0 MSS=1460 TSV=1969980 TSER=0 WS=2 0.000024 213.171.218.15 -> 85.247.162.18 TCP 80 > 57226 [SYN, ACK] Seq=0 Ack=1 Win=5792 Len=0 MSS=1460 TSV=10639608 TSER=1969980 WS=7 0.002265 85.247.162.18 -> 213.171.218.15 TCP 57226 > 80 [ACK] Seq=1 Ack=1 Win=5840 Len=0 TSV=1969981 TSER=10639608 0.004521 85.247.162.18 -> 213.171.218.15 HTTP GET / HTTP/1.1 0.004529 213.171.218.15 -> 85.247.162.18 TCP 80 > 57226 [ACK] Seq=1 Ack=386 Win=6912 Len=0 TSV=10639612 TSER=1969981 0.402945 213.171.218.15 -> 85.247.162.18 HTTP HTTP/1.0 200 OK (text/html) 0.402950 213.171.218.15 -> 85.247.162.18 HTTP Continuation or non-HTTP traffic 0.412859 85.247.162.18 -> 213.171.218.15 TCP 57226 > 80 [ACK] Seq=386 Ack=1449 Win=8736 Len=0 TSV=1970084 TSER=10640007 0.412867 213.171.218.15 -> 85.247.162.18 HTTP Continuation or non-HTTP traffic 0.413273 85.247.162.18 -> 213.171.218.15 TCP 57226 > 80 [ACK] Seq=386 Ack=1579 Win=8736 Len=0 TSV=1970084 TSER=10640007 0.418901 85.247.162.18 -> 213.171.218.15 TCP 57226 > 80 [ACK] Seq=386 Ack=2213 Win=11632 Len=0 TSV=1970085 TSER=10640017 Where my client ip address is 85.247.162.18 and my cache server ip address is 85.247.162.2. This means that the client ip spoofing is not working with tproxy4. Can any guide me ? -- Regards Hamid Hashemi

2 2

yahoo and hotmail never open
by sonu chouhan 11 Feb '09

11 Feb '09

hi, i am getting one more thing with the related problem, my local server where tproxy setup is 172.16.1.1 and i have run apache on it, normaly when i open 172.16.1.1 in browser it's open el5 default page and webserver works, but when i apply tproxy rules this page never open. and the same time normal website like google, orkut work fine. and if i use normal proxy it's open smoothly. i am using following iptables rules for tproxy. /sbin/ip rule add fwmark 0x1/0x1 lookup 100 /sbin/ip route add local 0.0.0.0/0 dev lo table 100 /iptables/sbin/iptables -t mangle -N DIVERT /iptables/sbin/iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT /iptables/sbin/iptables -t mangle -A DIVERT -j MARK --set-mark 0x1/0x1 /iptables/sbin/iptables -t mangle -A DIVERT -j ACCEPT /iptables/sbin/iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 3128 hi all, i am getting a problem with tproxy when i run a normal website it's working fine but when i login in yahoo or hotmail, sedond page never open and it's says following error's message Zero Sized Reply, server is too busy, timeout and when i run with normal tansparent proxy like redirect rule it's work fine, i am giving my setup below. rhel 5 with kernel 2.6.28.2 with patch of julian's routing patch (http://www.ssi.bg/~ja/) iptables-1.4.3rc1 squid-2.6.18 with tproxy patch of tproxy version2 and also check squid-3.1.0.4 with tproxy version4 i am using a server with 4 outgoing connection for internet and 1 internal connection for local network. please help me thanks in advance sonu...

2 1

Transparent proxying - different approach - NAT on demand.
by NTPT 11 Feb '09

11 Feb '09

Hi all. I have some proposition about squid and tproxy. I call it "NAT ON DEMAND". I am not really a good C programmer or kernel hacker, but... AFAIK in early tproxy days a dynamically created SNAT and DNAT rules, was considered but this idea was abandon as unfeasible. My idea is to allow "setting nat on application explicit demand". To create a infrastructure in with userspace application (squid for example) can send a "demand" for source address to witch their outgoing connections should be natted to - on per socket basis.Usage in transparent proxying of all kind. Especially useful for SQUID and realy transparent proxy scenario. The idea is roughly inspired and is analogic to "setting FWMARK from userspace", an old kernel patch that implement ioctl for setting fwmark on local originated packets on per socket basis. See http://oss.sgi.com/archives/netdev/2001-12/msg00053.html 1:applications should be able to explicitly set on per socket basis, on wich IP address they need outgoin connection to be SNATed. Probably add one 32bit item to skbuff and appropriate mechanizm for setting it from userspace 2: change netfilter / iptables to allow "-j SNAT --to-demand" option to witch set a source of the connection to address that application demanded 3: add "-m natdemand" iptables match to find if local originator of this connection demand NAT for it (ie if the additional field in skbuff is not 0x0 ). 4: patch squid to request a nat for its outgoing connections. Only thing that it should to take a client ip address and "demand it" Usage like this in squid conf acl src 192.168.1.0/24 transparent_clients # set ACL for clients network that we need handled transparently nat_on_demand transparent_clients # demand specific SNAT for all outgoing connections (ie connections that fetching content) it made on proxying clients from this network. ie take IP of the squid client and demand SNAT to this IP for outgoing sockets that fetching data for that client on cache miss (sorry my bad english) in iptables: iptables -t nat -I OUTPUT (or POSTROUTING ?) -m natdemand -j SNAT --to-demand # to tell netfilter to SNAT source address of that connection to what application demanded. ie copy address stored in additional skbbuff field >From that point, all the hard work for us is done automatically by netfilter.No need to worry about fancy routing setup etc. No need additional overhead for socket match. Does not interfer with connection tracking as tproxy afaik does. Should work for related (icmp etc) packets as well. Should instantly work for every protocol that have nat helper too. Should be easy to implement and less intrusive (afaik most of tproxy patch is to circumvent some kernel safety measurements and control checks on various places) Or miss I some point ? PS: excuse my wrong english, that limit severally my ability to express this idea.

3 2