- tproxy - lists.balabit.hu

question about tproxy on bridgy mode
by Junyong Jiang 06 Feb '09

06 Feb '09

Hi all, I read some one have the expirence on tproxy and squid using in bridgy mode on internet. So I met some problems of this case, I think you can give me some important information. Thanks in advance. When I configure the tproxy and squid in tproxy mode, and run the client requesting. The tproxy target can be called and redirecting the packet, but the request packet is also directly passed to the server. The server gave the reply correctly. But the local host process never client tcp SYN packet. I did not know what's the real problem, I think it is about the routing policy. Could you offer me some help please! Thank you! Alex 2009-02-05

1 0

yahoo and hotmail never open
by sonu chouhan 02 Feb '09

02 Feb '09

hi all, i am getting a problem with tproxy when i run a normal website it's working fine but when i login in yahoo or hotmail, sedond page never open and it's says following error's message Zero Sized Reply, server is too busy, timeout and when i run with normal tansparent proxy like redirect rule it's work fine, i am giving my setup below. rhel 5 with kernel 2.6.28.2 with patch of julian's routing patch (http://www.ssi.bg/~ja/) iptables-1.4.3rc1 squid-2.6.18 with tproxy patch of tproxy version2 and also check squid-3.1.0.4 with tproxy version4 i am using a server with 4 outgoing connection for internet and 1 internal connection for local network. please help me thanks in advance sonu...

1 0

ip_tproxy.h problem
by sonu chouhan 29 Jan '09

29 Jan '09

hi all, i am getting a problem! my setup is - Redhat el5 kernel 2.6.28.2 with support of tproxy iptables v1.4.3-rc1 with support of tproxy squid 3.0STABLE12 with support of tproxy squid config : ./configure --prefix=/squid/3.0.12 --enable-linux-netfilter --enable-linux-tproxy kernel and iptables are compile and work fine, but when i am going to compile squid it's show transparent proxy support enable automaticly but after some line it show ip_tproxy.h no. after compile when i put line "http_port 3128 tproxy" in squid.conf it again show error. i install all header from kernel source but error is same and when i search for file ip_tproxy.h there is no file in my system. i have try many thing change kernel, iptables but no succcess, then i compile squid-2.6STABLE18 with patch "tproxy-squid-2.6-STABLE18.20080304-110716-1204625236.patch" and it's working fine and no error. so please help me in compiling squid 3.0. Thanks in advance sonu...

3 2

patch for iptables 1.4.1.1
by sonu chouhan 26 Jan '09

26 Jan '09

hi all, i am new for tproxy, i have compile kernel 2.6.28 with tproxy support and i have squid 2.7.5 and both have already support tproxy. my question is where can i get patch for iptables-1.4.1.1 bcoz iptables not support tproxy yet, and there is no patch on official download site (i.e. http://www.balabit.com/downloads/files/tproxy/) for iptables-1.4.1.1, please guide me thanks in advance sonu..

2 1

Re: [tproxy] TPROXY-4 and ip contract
by elyasaf 20 Jan '09

20 Jan '09

Not "ip contract" but "ip conntrack" ("connection tracking support"). _____ From: tproxy-request(a)lists.balabit.hu Sent: Tuesday, January 20, 2009 11:06 AM To: 'tproxy(a)lists.balabit.hu' Subject: TPROXY-4 and ip contract Why do i need "ip contract" for using getsockopt with the option SO_ORIGINAL_DST?

2 1

IP_TRANSPARENT - cause to very slow connect
by elyasaf 20 Jan '09

20 Jan '09

When i'm not using "IP_TRANSPARENT", the connect takes something near 4 miliseconds. With the "IP_TRANSPARENT", the first run of the client is fast, but the second and more takes more than 2 seconds (sometimes even 10)! What takes for the "connect" so much time?

2 1

TPROXY-4 and ip contract
by elyasaf 20 Jan '09

20 Jan '09

Why do i need "ip contract" for using getsockopt with the option SO_ORIGINAL_DST?

1 0

TPROXY4 and Squid-2/Cacheboy support
by Adrian Chadd 16 Jan '09

16 Jan '09

G'day, I've coded up some basic TPROXY4 support for my Squid-2 derivative, Cacheboy. The HEAD version of Cacheboy should support both TPROXY2, TPROXY4 and the FreeBSD-current tproxy-like functionality. The TPROXY4 support will make it back into Squid-2 at some point. I unfortunately don't have any local setup here to properly test the TPROXY2 or TPROXY4 support; would someone on this list be able to give me a hand in verifying that the code does as advertised? (The TPROXY2 code is based on the TPROXY2 support from Squid-2.HEAD, but I've tried modularising it somewhat so it can be easily replaced by other transproxy implementations, such as the FreeBSD and OpenBSD variants. This is why I'd also like some help testing the legacy code. :) Thanks! Adrian

2 2

tproxy target implementation problem on kernel-2.6.22
by kudiejlq 18 Dec '08

18 Dec '08

hi, I have being modified linux-kernel-2.6.22 to support the function as tproxy dose to linux-kernel-2.6.24 these week. And now, the socket match can work well, while the TPROXY target meet some problems. kernel's panic info was shown in the slave file picture. iptables rule was as bellow: iptables -t mangle -A PREROUTING -p tcp --dport 1080 -j TPROXY --on-port 2080 As you see, I didn't specify the --tproxy-mark option, that's say the kernel panic info were produced during find the target listenning socket. when recv a remote syn pkt preduced by command telnet 10.24.38.28 1080, tproxy kernel die. Any suggestions to solve this problem, thank you! regards! ----------------------------- kudiejlq

1 0

socket match can't work with DNAT rules
by Dong Wei 17 Dec '08

17 Dec '08

Hi, all I use the latest tproxy kernel.But I find that, tproxy can't work with DNAT mode. network topology: Web Server(192.168.1.10)----(192.168.1.1)TPROXY Server(202.0.0.1)---(202.0.0.10)Client For TPROXY Server eth0 192.168.1.1 eth1 202.0.0.1 When Client visit TPROXY Server(202.0.0.1) 80 port, we will redirect it to Web Server. There is a DNAT rule for it. iptables -t nat -i eth1 -d 202.0.0.1 -p tcp --dport 80 -j DNAT --to-destination 192.168.1.10 tproxy APP listen on port 50080, and the TPROXY target also set --on-port 50080 for HTTP. Here is the problem: 1. Client send SYN to 202.0.0.1:80 2. TPROXY Server receive it, and TPROXY target will redirect this packet to the socket which is listening on port 50080 3. TPROXY Server send SYN,ACK to the Client 4. Client receive SYN,ACK and send ACK 5. TPROXY Server receive ACK, TPROXY target will redirect this packet to the socket listening on port 50080 6. With DNAT rule, the established socket is 202.0.0.10:port -> 192.168.1.10:80 7. Client send "GET " request to TPROXY Server 8. socket match find this packet doesn't match any socket. For its sip, sport, dip,dport is 202.0.0.10:port -> 202.0.0.1:80, while the established socket is 202.0.0.10:port -> 192.168.1.10:80 So in this case, match can't work correctly for DNAT rules. Anyone has good ideas? Thanks in advance! -- Thanks BR. Wei Dong

3 5