- tproxy - lists.balabit.hu

difference between two patches
by Ritter, Nicholas 22 Jul '08

22 Jul '08

Is the difference between tproxy-iptables-20080204-1915.patch <http://www.balabit.com/downloads/files/tproxy/tproxy-iptables-20080204- 1915.patch> and tproxy-iptables-1.4.0-20080521-113954-1211362794.patch <http://www.balabit.com/downloads/files/tproxy/tproxy-iptables-1.4.0-200 80521-113954-1211362794.patch> the version of iptables that it patches? ( example: tproxy-iptables-1.4.0-20080521-113954-1211362794.patch <http://www.balabit.com/downloads/files/tproxy/tproxy-iptables-1.4.0-200 80521-113954-1211362794.patch> is only for 1.4 and tproxy-iptables-20080204-1915.patch <http://www.balabit.com/downloads/files/tproxy/tproxy-iptables-20080204- 1915.patch> in for pre-1.4) Nick

2 1

cttproxy question
by Ritter, Nicholas 21 Jul '08

21 Jul '08

I have two quick question about the old cttproxy patches: 1) is "echo 1 > /proc/sys/net/ipv4/ip_nonlocal_bind" needed? 2) is only one iptables rule needed? I am using : "iptables -t tproxy -A PREROUTING -s 10.48.1.0/16 -p tcp -m tcp --dport 80 -j TPROXY --on-port 80 --on-ip 0.0.0.0" and it is not working. I still see the ip of the squid box, and not the original client. It seems as though the problem is in iptables somewhere. I am using this as part of a L3/L4 WCCP/Squid setup and not a bridging solution. I have looked at multiple tproxy howtos...only one worked, and it was a bridging solution on Debian. But I am not using Debian, and I can't use a bridging solution.

1 0

soft error with cttproxy
by Ritter, Nicholas 18 Jul '08

18 Jul '08

Greetings all, I am seeing an tproxy error in my squid cache.log that I am wanting to gain more understanding of the implications of. TProxy is working, but I was curious if the error noted below is going to give me problems down the road, much less any information about the error. The error in the log seems to be cutoff, which doesn't make it any easier to isolate, and I don't know how to remedy that. After the error listing, I have provided the details of the setup. Any input would be helpful. Thanks, Nicholas Error in squid cache.log: 2008/07/16 15:21:20| tproxy ip=10.48.1.3,0x301300a,port=0 ERROR ASSIGN 2008/07/16 15:21:24| tproxy ip=10.48.1.3,0x301300a,port=0 ERROR ASSIGN 2008/07/16 15:21:52| NETDB state saved; 0 entries, 0 msec 2008/07/16 15:23:35| tproxy ip=10.48.1.3,0x301300a,port=0 ERROR ASSIGN 2008/07/16 15:24:41| tproxy ip=10.48.1.3,0x301300a,port=0 ERROR ASSIGN Details of setup: software versions: CentOS 5.2 x86_64 linux distributions squid-2.6.STABLE21 cttproxy-2.6.18-2.0.6 vanilla 2.6.18 kernel, custom compiled (I did choose the NAT reservations support in addition the other TProxy options.) iptables-1.3.5-4 source rpm, patched and built via rpmbuild with the cttproxy diff squid build options: CHOST="x86_64-pc-linux-gnu" \ CFLAGS="-DNUMTHREADS=60 \ -O3 \ -pipe \ -funroll-loops \ -ffast-math \ -fno-exceptions" \ ./configure \ --prefix=/usr/local/squidapp \ --exec-prefix=/usr/local/squidapp \ --enable-async-io \ --enable-icmp \ --enable-snmp \ --enable-cache-digests \ --enable-useragent-log \ --enable-storeio="aufs" \ --enable-follow-x-forwarded-for \ --enable-removal-policies="heap,lru" \ --with-maxfd=16384 \ --enable-poll \ --disable-ident-lookups \ --enable-delay-pools \ --enable-linux-netfilter \ --enable-linux-tproxy Other patches that came with the iptables rpm that were applied to the IPTables source:Patch2: iptables-1.2.8-nolibnsl.patch Patch4: iptables-1.2.9-netlink.patch Patch5: iptables-1.3.0-selinux.patch Patch6: iptables-1.2.10-counters.patch Patch8: iptables-1.3.0-cleanup.patch Patch9: iptables-1.3.0-autoload.patch Patch10: iptables-1.3.0-no_root.patch Patch11: iptables-1.3.5-dscp_max.patch Patch12: iptables-1.3.5-headers.patch Squid deployment is using the setup as detailed onthe squid WiKi at: http://wiki.squid-cache.org/ConfigExamples/FullyTransparentWithTPROXY This squid deployment using using WCCP v2 with a Cisco router, and two squid services as itemized in the WiKi article, where one wccp service is bound to the inbound traffic, and one to the outbound traffic like this: wccp2_service dynamic 80 wccp2_service_info 80 protocol=tcp flags=src_ip_hash priority=240 ports=80 wccp2_service dynamic 90 wccp2_service_info 90 protocol=tcp flags=dst_ip_hash,ports_source priority=240 ports=80 Like I said, the whole setup is working nicely...but I have only tested it with serving less than 10 clients, and I want to make sure the error I am seing is not going to give me performance/stability problems down the road. Once I resolve this issue, I will be posting to the Squid Wiki and to anyone who is interested a CentOS 5.2 HOWTO.

2 1

Squid issue
by Munawar Zeeshan (zmunawar) 17 Jul '08

17 Jul '08

Hi All.. At last after some struggle I configured some part of tproxy. Now when I configure squid it is giving me error /configure --enable-linux-tproxy --enable-linux-netfilter --enable-storeio="diskd,aufs,ufs" --enable-removal-policies="lru,heap" --enable-delay-pools --enable-snmp --enable-arp-acl --enable-cache-digests --enable-linux-netfilter --disable-ident-lookups --enable-underscores --enable-auth="basic" --enable-basic-auth-helpers="NCSA" --with-maxfd=8192 checking if Linux 2.4 or newer kernel header files are installed... no WARNING: Cannot find necessary Linux kernel header files Linux Netfilter Transparent Proxy support WILL NOT be enabled checking if TPROXY header files are installed... no make all /usr/include/linux/netfilter.h:41: error: expected specifier-qualifier-list before â__be32â make[3]: *** [client_side.o] Error 1 make[3]: Leaving directory `/root/Desktop/squid-2.6.STABLE9/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/root/Desktop/squid-2.6.STABLE9/src' make[1]: *** [all] Error 2 make[1]: Leaving directory `/root/Desktop/squid-2.6.STABLE9/src' make: *** [all-recursive] Error 1 make install from client_side.c:96: /usr/include/linux/netfilter.h:41: error: expected specifier-qualifier-list before â__be32â make[3]: *** [client_side.o] Error 1 make[3]: Leaving directory `/root/Desktop/squid-2.6.STABLE9/src' make[2]: *** [install-recursive] Error 1 make[2]: Leaving directory `/root/Desktop/squid-2.6.STABLE9/src' make[1]: *** [install] Error 2 make[1]: Leaving directory `/root/Desktop/squid-2.6.STABLE9/src' make: *** [install-recursive] Error 1 Can anybody help me thanks

1 0

TProxy installation
by Munawar Zeeshan (zmunawar) 16 Jul '08

16 Jul '08

After doing much effort and using different options , I am still unable to get through tproxy. I have FC4, FC8. Please advice ma which one shuld I use. In addition to please also tell me the patches and other software versions I should use. I am much confused about the versions and may be that the problem I am unable to get through the tproxy. If any one has already configured it then plz share experience with me Thanks

3 2

Re: [tproxy] tproxy 4.1.0 in bridge mode
by sameer khan 15 Jul '08

15 Jul '08

> From: mingching.tiew(a)redtone.com> To: tproxy(a)lists.balabit.hu> Date: Tue, 8 Jul 2008 14:47:26 +0800> Subject: Re: [tproxy] tproxy 4.1.0 in bridge mode> > sameer khan wrote:> > hi guys> > > > i am trying to work out tproxy 4.1.0 bridge mode, any one using it> > please me know what kernel, iptables and squid version. > > > > I have test it with kernel 2.6.24.19 but ebtables causes kernel> > panic, really am confused. > > > > > > We can't see through the crystal ball to know what ebtables > commands you have used to panic the kernel, you should> test your ebtables thingie with a stock kernel without applying> any patches. If it still panic, file a bug report with the linux kernel > team, it has nothing to do with tproxy.> > > _______________________________________________> tproxy mailing list> tproxy(a)lists.balabit.hu> https://lists.balabit.hu/mailman/listinfo/tproxy hey ming thanks for reply, i read the command if i m not mistaken written by yourself INSIDE_DEV=eth0OUTSIDE_DEV=eth1 ebtables -t broute -A BROUTING -i $INSIDE_DEV -p ipv4 \ --ip-protocol tcp --ip-destination-port 80 \ -j redirect --redirect-target DROP ebtables -t broute -A BROUTING -i $OUTSIDE_DEV -p ipv4 \ --ip-protocol tcp --ip-source-port 80 \ -j redirect --redirect-target DROPthe above command are causing kernel panic. so if you may be kind enough enlighten me. which kernel version you test with and the version of iptables and squid. thanks, really appreciated any help _________________________________________________________________ Invite your Facebook friends to chat on Messenger http://clk.atdmt.com/UKM/go/101719649/direct/01/

3 3

squid 3.0stable1+tproxy4.1.0+iptables1.4.0
by sameer khan 14 Jul '08

14 Jul '08

hello i m getting this after compiling squid with --enable-linux-tproxy4. iptables 1.4.0 is patched and compiled. FATAL: Bungled squid.conf line 835: http_port 3128 tproxySquid Cache (Version 3.0.STABLE1): Terminated abnormally.CPU Usage: 0.010 seconds = 0.000 user + 0.010 sysMaximum Resident Size: 0 KBPage faults with physical i/o: 0 kernel 2.6.24.19 is compiled with tproxy support: #dmesg | grep -i proxy [ 90.818086] NF_TPROXY: Transparent proxy support initialized, version 4.1.0[ 90.818092] NF_TPROXY: Copyright (c) 2006-2007 BalaBit IT Ltd. loaded modules : #lsmod | grep -i tproxy xt_TPROXY 3584 0nf_defrag_ipv4 3328 1 xt_TPROXYnf_tproxy_core 5120 1 xt_TPROXY,[permanent]x_tables 16132 2 xt_TPROXY,ip_tables will be thankfull for any help Thanks _________________________________________________________________ Find the best and worst places on the planet http://clk.atdmt.com/UKM/go/101719807/direct/01/

2 1

Squid3 + Tproxy
by Emerson Gregorio 14 Jul '08

14 Jul '08

Hello! Have compiling the kernel 2.6.24 with the patch of tproxy and also the iptables. When running lsmode | grep TPROXY, the modules are running. Have compiling the Squid 3 with the option - enable-linux-tproxy4, in the compilation not happening I do not see this option, but neither gave any error. When I try to run the squid with the option: http_port 3128 tproxy, gives error in the squid. And I can not go there. Does tá missing something? As I look, Emerson Gregorio

4 8

Auto upload modules
by Munawar Zeeshan (zmunawar) 14 Jul '08

14 Jul '08

I am using FC4.I installed kernel 2.6.20.17 and patched it with tproxy. then doing MAKE MENUCONFIG I enabled tproxy options. Now I want to load it as auto moduels. In /cat/modeprobe.conf I added following lines. ip_tables iptable_filter ipt_TPROXY ipt_tproxy iptable_tproxy after rebooting the system I see following errors in my /var/log/messages [root@localhost ~]# tail -f /var/log/messages Jul 14 11:13:56 localhost modprobe: WARNING: /etc/modprobe.conf line 12: ignoring bad line starting with 'ipt_TPROXY' Jul 14 11:13:56 localhost modprobe: WARNING: /etc/modprobe.conf line 13: ignoring bad line starting with 'ipt_tproxy' Jul 14 11:13:56 localhost modprobe: WARNING: /etc/modprobe.conf line 14: ignoring bad line starting with 'iptable_tproxy' Also ther was no result if I do lsmod | grep -i proxy Any help plz, how can I load the tproxy as modules on startup in FC4 tproxy(a)lists.balabit.hu<tproxy(a)lists.balabit.hu>;

2 1

Help Required
by Munawar Zeeshan (zmunawar) 11 Jul '08

11 Jul '08

Hi I have seen in the forum that a lot of people are using squid with TProxy. I also want to do the same, but unfortunately till yet havent unable to even patch the kernl successfully. Please can somebody provide me the complete config steps.I will be much obliged to him Thanks shani

1 0