- tproxy - lists.balabit.hu

tproxy not forward the source ip
by HADI UTOMO 03 Aug '08

03 Aug '08

hello, can some one help to to solve the problem. i have a bridge machine whit kernel 2.6.20 that already patched whit balabit patch + iptables 1.3.7 ( patched ) + squid 2.6.stable 21 ( enabled tproxy ) but why when i get to browse my web server from my laptop, my web server log show to me that the web request came from the tproxy ip ? if i'm not wrong.. the request must came from my laptop ip... on the web server log. but when i check my bridge machine, it's show all is fine and the squid access.log show that my laptop has request for the web... here is my network diagram: laptop <--> | eth1 === bridge == eth0 | <---> web server laptop : 10.0.0.1 bridge : 10.0.0.253 <--- default gw 10.0.0.2 web server : 10.0.0.2 i add on my squid.conf : http_port 3128 transparent tproxy tcp_outgoing address 10.0.0.253

1 0

squid 2.6 and tproxy
by admin＠abp.pl 01 Aug '08

01 Aug '08

Hello, I'm back from vacation and I'm not fresh with tproxy now. Is any working solution for fully transparent squid 2.6 with kernel >2.6.22 ? Regards, -- Tomasz Kolaj Administrator sieci ABP Computer

1 0

tproxy won't request whit the source ip
by HADI UTOMO 01 Aug '08

01 Aug '08

hi. i'm make a bridge whit open suse 10.2 and get tproxy patched on the box. all step has finished,and no error... at the squid acceess.log i see the request traffict from client ip, but why on the web server log or on the router the request for the web is came from the bridge ip not the original ip ( client ). I have net.ipv4. & ip_nonlocal_bind = 1 my squid get compiled whit --enable-linux-tproxy. when i tcpdump on the ethetnet that shown a request / search the dns / ip of the destination server but, the squid did not request the web.and the client get error message ( 22 ) here is my network diagram : Client ( 10.0.0.0/24 ) < -- > | eth0 = Bridge = eth1 | <--> router (10.0.0.254) <--> web srvr | tproxy + squid 2.6 stable 21 here the script : ifconfig eth0 down ifconfig eth1 down ifconfig eth0 0.0.0.0 up ifconfig eth1 0.0.0.0 up brctl addbr br0 brctl addif br0 eth0 brctl addif br0 eth1 ifconfig br0 10.0.0.250 up route add default gw 10.0.0.254 brctl stp off btctl setfd br0 off ebtables -t broute -A BROUTING -p IPv4 --ip-protocol 6 --ip-destination-port 80 -j redirect --redirect-target ACCEPT iptables -t tproxy -A PREROUTING -i br0 -p tcp -m tcp --dport 80 -j TPROXY --on-port 3128

1 0

Squid Source Port for Outbound
by Ted Kaczmarek 30 Jul '08

30 Jul '08

Will Tproxy reuse the same source port for outbound requests on the clients behalf or will it genertate a new source port? I am thinking for transpareny the source port should be the same, but I would like to verify that. Regards. Ted

1 0

Making a PEP with tproxy and haproxy
by Diego M. Vadell 28 Jul '08

28 Jul '08

Hi, We have a satellite link between an ethernet networks full of windows PCs and the internet. Windows PCs don't have it's TCP stack optimized for a satellite link (i.e. 700ms delay, 3Mbps) so they barely use it (they wait for acks and use a little sliding-window, so the rtt kills the throughput). Our ISP uses something called a PEP,: a tcp proxy that answers all the LAN's tcp connections. This PEP is well optimized, so it can fully use the satellite link and feed the ethernet PCs at full speed. This page: http://www.sonet.at/dsdsl-vpn/dsdsl-vpn.htm explains the problem with more detail. Everything works OK except when we put a VPN to connect this place with another office. The PEP is on the ISP's side, so it sees IPSEC traffic. So I want to make a PEP (or say, a proxy that can transparently proxy any tcp connection) in the inside. From reading I think it can be done: haproxy has tproxy support, so I could tproxy everything to haproxy, and tune the TCP stack of the proxy for the satellite link. But as I have never done it, I thought I may ask: Am I missing something horribly big here? Thanks in advance, -- Diego.

2 2

BRIDGE + IMQ + TPROXY
by HADI UTOMO 26 Jul '08

26 Jul '08

hello.. i'm new on linux, can some one help me whit my case.. i'm planning to make a bridge whit imq ( htb/ cbq bandwidth shapper running ) + tproxy running on the bridge. all connection from local network to the internet must be shapped and get proxyed by tproxy at the bridge before reach the adsl modem. now i'm allready compiled the kernel + iptables + squid 2.6 whit imq & tproxy patch and run well when i test the iptables whit tproxy sample script, now my problem is how look like is the syntax for iptables so my box can running as bridge,shapper and proxy ? here is my bridge setting : -------------------- # bridge.sh ifconfig eth0 down ifconfig eth1 down ifconfig eth0 0.0.0.0 up ifconfig eth1 0.0.0.0 up brctl addbr br0 brctl addif br0 eth0 brctl addif br0 eth1 ifconfig br0 192.168.1.253 up route add default gw 192.168.1.254 brctl stp off btctl setfd br0 off --------------------

1 0

Squid 3 head errors with interception
by Ritter, Nicholas 25 Jul '08

25 Jul '08

I have been talking with developers on the squid-dev list about issues with havign both tproxy and interception enbaled on the same listen port when using WCCP, Squid 3.1 (squid 3 HEAD), and TProxy 4.1.0. The discussion revolves around the following errors in cache.log: 2008/07/25 12:38:57| IPInterception.cc(171) NetfilterTransparent: NF getsockopt(IP_TRANSPARENT) failed: (92) Protocol not available 2008/07/25 12:47:12| IPInterception.cc(137) NetfilterInterception: NF getsockopt(SO_ORIGINAL_DST) failed: (11) Resource temporarily unavailable And occasional (99) errors seen by the client. It had been mentioned that interception and tproxy options should not be used together in a WCCP setup, but there is confusion as to how to seperate them, mush less if it is really required. Anyone have comments on this? Nick

1 0

Merging tproxy patch to standard kernel ?
by Yoshioka Tsuneo 23 Jul '08

23 Jul '08

Hello It is often required to keeping source address on proxy, and tproxy seems be almost only one solution. Now, it seems be very nice if tproxy patch is merged to standard kernel. Is there any plan to merge tproxy to standard kernel ? Thank you ! -- Nihon F-Secure Corporation Yoshioka Tsuneo E-MAIL: Tsuneo.Yoshioka(a)f-secure.com

3 5

tproxy related error in squid?
by Ritter, Nicholas 22 Jul '08

22 Jul '08

I see an error in my squid cache.log that I think is TProxy related, and wanted to post it here to see if anyone had input before posting it to the squid list. The versions of everything I am using is listed below, followed by the error. Software versions: squid-3.HEAD-20080721 iptables 1.4.0 kernel 2.6.25.11 This is part of a WCCP setup with a Cisco router. My iptables setup is: Table: filter Chain INPUT (policy ACCEPT) num target prot opt source destination 1 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 2 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 3 ACCEPT 47 -- 0.0.0.0/0 0.0.0.0/0 4 ACCEPT 47 -- 0.0.0.0/0 0.0.0.0/0 5 LocalFW all -- 0.0.0.0/0 0.0.0.0/0 Chain FORWARD (policy ACCEPT) num target prot opt source destination 1 LocalFW all -- 0.0.0.0/0 0.0.0.0/0 Chain OUTPUT (policy ACCEPT) num target prot opt source destination Chain LocalFW (2 references) num target prot opt source destination 1 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 2 ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 255 3 ACCEPT udp -- 10.48.33.2 0.0.0.0/0 udp dpt:2048 4 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 5 ACCEPT tcp -- 10.9.7.206 0.0.0.0/0 tcp dpt:22 state NEW 6 ACCEPT tcp -- 10.2.5.100 0.0.0.0/0 tcp dpt:22 state NEW 7 ACCEPT tcp -- 10.9.7.206 0.0.0.0/0 tcp dpt:10000 state NEW 8 ACCEPT udp -- 10.2.5.100 0.0.0.0/0 udp spt:161 9 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:8080 10 ACCEPT tcp -- 10.9.7.206 0.0.0.0/0 tcp dpt:10000 11 REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited Table: mangle Chain PREROUTING (policy ACCEPT) num target prot opt source destination 1 DIVERT tcp -- 0.0.0.0/0 0.0.0.0/0 socket 2 TPROXY tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 TPROXY redirect 0.0.0.0:3128 mark 0x1/0x1 Chain INPUT (policy ACCEPT) num target prot opt source destination Chain FORWARD (policy ACCEPT) num target prot opt source destination Chain OUTPUT (policy ACCEPT) num target prot opt source destination Chain POSTROUTING (policy ACCEPT) num target prot opt source destination Chain DIVERT (1 references) num target prot opt source destination 1 MARK all -- 0.0.0.0/0 0.0.0.0/0 MARK set 0x1 2 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 The squid clients are in the 10.48.1.0/24 subnet, the router is in both the 10.48.1.0/24 and the 10.48.33.0/24 subnet. The squid box is 10.48.33.2, the router is 10.48.33.1. Both IP subnets are seperate layer 2 vlans. In the errors below, 10.48.1.200 is my client test machine. Error with "echo 0 > /proc/sys/net/ipv4/ip_nonlocal_bind": 2008/07/22 12:57:05| IPInterception.cc(137) NetfilterInterception: NF getsockopt(SO_ORIGINAL_DST) failed: (11) Resource temporarily unavailable 2008/07/22 12:57:05| IPInterception.cc(171) NetfilterTransparent: NF getsockopt(IP_TRANSPARENT) failed: (92) Protocol not available Error with "echo 1 > /proc/sys/net/ipv4/ip_nonlocal_bind": 2008/07/22 13:01:50| IPInterception.cc(137) NetfilterInterception: NF getsockopt(SO_ORIGINAL_DST) failed: (11) Resource temporarily unavailable 2008/07/22 13:01:50| IPInterception.cc(171) NetfilterTransparent: NF getsockopt(IP_TRANSPARENT) failed: (92) Protocol not available 2008/07/22 13:01:54| commBind: Cannot bind socket FD 30 to 10.48.1.200:5675: (98) Address already in use 2008/07/22 13:01:54| comm.cc(997) commResetFD: bind: (98) Address already in use

1 1

tproxy 4.1 NAT question
by Ritter, Nicholas 22 Jul '08

22 Jul '08

Am I assuming correctly that the the iptables nat rule IS needed as show in the beginning of item 1 unter "How to start using it?" in the readme or is that simple a reference of how it was done before? To clarify, does the iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --on-port <proxyport> \ --tproxy-mark 0x1/0x1 replace the iptables -t nat -A PREROUTING -j DNAT --to-dest <localip> --to-port <proxyport> Thanks, Nick

1 0