- tproxy - lists.balabit.hu

(no subject)
by Munawar Zeeshan (zmunawar) 11 Jul '08

11 Jul '08

Hi all, I want to configure tproxy. here wha I did but getting error. I have FC4 with kernel 2.6.11. I downloaded it and xtracted it to /usr/src/. then I patched kernel as following #for i in /usr/src/cttproxy-2.6.20-2.0.6/patch_tree/01-nat_reservations.patch; do cat $i | patch -p1; done # for i in /usr/src/cttproxy-2.6.20-2.0.6/patch_tree/02-tproxy.patch; do cat $i | patch -p1; done # for i in /usr/src/cttproxy-2.6.20-2.0.6/patch_tree/03-nat_delete.patch; do cat $i | patch -p1; done After this I go to make menuconfig and go to IP: Netfilter Configuration ---> <*> IP tables support (required for filtering/masq/NAT) <*> Full NAT after enabling NAT I don't see any IP: Netfilter Configuration ---> <*> Transparent proxying <M> tproxy match support <M> TPROXY target support I think my kernel is still not propoerly patched. I am using following link for reference , http://fuzzylab00net.blog.dada.net/post/413913/Squid-2.6-+-tproxy-+-bridge-… Can anybody help me and provide me complete documentation. I want to implement a squid so that after squid I doesn't get the nated IP, but instead I get original source IP Thanks a lot

1 0

tproxy 4.1.0 in bridge mode
by sameer khan 08 Jul '08

08 Jul '08

hi guys i am trying to work out tproxy 4.1.0 bridge mode, any one using it please me know what kernel, iptables and squid version. I have test it with kernel 2.6.24.19 but ebtables causes kernel panic, really am confused. Regards _________________________________________________________________ 100’s of Nikon cameras to be won with Live Search http://clk.atdmt.com/UKM/go/101719808/direct/01/

2 1

cttproxy 2.0.6 for kernel 2.6.18 and squid 3.0.stable7 ?
by Jérôme Santini 08 Jul '08

08 Jul '08

Hello I am still trying to understand what are the right version of the tproxy patch and squid to use for now on a production system. Should the cttproxy 2.0.6 for linux 2.6.18 and squid 3.0.stable7 with --enable-linux-tproxy be a matching configuration ? If not, what are the currently recommended versions of both software to use for production ? J.

1 0

need help with haproxy routing rules
by Jeffrey 'jf' Lim 01 Jul '08

01 Jul '08

hi, folks, I've been scratching my head over this, and need your help with this. I've got haproxy compiled with tproxy support, and it's working fine with regards to point no. 3 ("Initiating connections with a foreign address as a source") - I've got it binding and connecting properly, and it's able to send out packets using a foreign address. Problem now is, when the reply packet comes back, haproxy cant seem to be able to detect it? The route rules in the readme are tuned for a full transparent proxy, listening on another port other than the port of the traffic you want to transparently listen to, which is fine for squid - but this is not what I'm looking for. As far as i've figured, the following rules should work, but dont somehow: ====== iptables -t mangle -N DIVERT iptables -t mangle -A PREROUTING -p tcpo -m socket -j DIVERT iptables -t mangle -A DIVERT -j MARK --set-xmark 0x1/0xffffffff iptables -t mangle -A DIVERT -j ACCEPT ===== The rule iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --on-port <proxyport> --tproxy-mark 0x1/0x1 isn't applicable here, because haproxy IS supposed to be "non-transparent" at the client end - it IS supposed to listen in directly on the ip and port for web traffic - that's the point of a load balancer, so... Could somebody perhaps tell me what i need to complete the setup, and get the packets to be forwarded to haproxy? thanks, -jf -- In the meantime, here is your PSA: "It's so hard to write a graphics driver that open-sourcing it would not help." -- Andrew Fear, Software Product Manager, NVIDIA Corporation http://kerneltrap.org/node/7228

1 1

TPROXY is not working
by Nataniel Klug 26 Jun '08

26 Jun '08

People, I have made everything I told you before but I put an fixed ip into my cache. Its ip is 200.163.208.14 and my clients are all valid ips behind this cache. I am at IP 200.163.208.10 and when I use www.meuip.com.br to discover my ip address i find: Meu ip é *200.163.208.14* *Mais Informações* IP Reverso *200.163.208.14* Data *15h26min - 26/06/2008 * So this is wrong. I have made this scripts into my system: FIREWALL #!/bin/bash #---- # Variaveis de Sistema #---- IPT="/sbin/iptables" RT="/sbin/route" DIR="/etc/firewall" #---- # Regras gerais de tratamento de pacotes #---- $IPT -F $IPT -t nat -F $IPT -t nat -X $IPT -X $IPT -F INPUT $IPT -F FORWARD $IPT -F OUTPUT #---------- # Aceita todas as conexoes do loopback #---------- $IPT -A INPUT -i lo -j ACCEPT $IPT -A FORWARD -i lo -j ACCEPT #---------- # Ping-of-Death, Syn-Flood, Port-Scanner # Permissao de ping para as interfaces locais #---------- $IPT -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT $IPT -A FORWARD -p tcp --syn -m limit --limit 1/s -j ACCEPT $IPT -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT $IPT -A INPUT -p icmp -m limit --limit 1/s -j ACCEPT #---------- # Aceita conexoes estabelecidades #---------- $IPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT $IPT -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT $IPT -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT #---------- # LOG e DROP de pacotes fragmentados #---------- $IPT -A FORWARD -m state --state INVALID -j DROP $IPT -A INPUT -f -j LOG --log-prefix "Pacote INPUT fragmentado: " $IPT -A INPUT -f -j DROP $IPT -A FORWARD -f -j LOG --log-prefix "Pacote FORWARD fragmentado: " $IPT -A FORWARD -f -j DROP #---------- # Declara IP dos Servidores #---------- QOS="200.163.208.2" MAIL="200.163.208.6" CACHE="172.31.0.2" #---------- # Declara redes utilizadas por este cache #---------- V01="200.163.208.0/30" # rede roteador/qos V02="200.163.208.4/30" # rede qos/mail V03="200.163.208.8/30" # rede CNett - Escritorio V04="200.163.208.12/30" # rede qos/cache V05="200.163.208.16/28" # rede RESERVADA V06="200.163.208.32/27" # rede RESERVADA V07="200.163.208.64/26" # rede CLIENTES IP/FIXO (subnets no ptp.mk.elj) V08="200.140.222.128/25" # rede RESERVADA V09="201.35.16.0/24" # rede PPPoE EMA (201.35.16.0/25) e EMS (201.35.16.128/25) V10="200.101.166.0/24" # rede PPPoE ELJ I01="172.31.0.0/30" # rede BACKBONE CNett cache > ptp.mk.elj PTP="172.16.0.0/24" # rede PTP CNett (ELJ>EMA/ELJ>EMS/ELJ>CNETT) (subnets no ptp.mk.elj) APS="10.0.0.0/8" # rede APS (ELJ/EMA/EMS/CNETT) (subnets no ptp.mk.elj) #--------- # Redes com NAT #--------- EMS_LOCAL="192.168.40.0/24" #---------- # Declara rotas para redes distantes #---------- $RT add -net $V03 gw $CACHE $RT add -net $V07 gw $CACHE $RT add -net $V09 gw $CACHE $RT add -net $V10 gw $CACHE $RT add -net $PTP gw $CACHE $RT add -net $APS gw $CACHE $RT add -net $EMS_LOCAL gw $CACHE #---------- # DMZ #---------- #/etc/firewall/dmz #---------- # Regras para funcionamento do Conectividade Social da CEF #---------- #$IPT -t nat -A PREROUTING -d 200.201.166.100 -p tcp --dport 80 -j DNAT --to 200.201.166.100 #$IPT -t nat -A PREROUTING -d 200.201.169.69 -p tcp --dport 80 -j DNAT --to 200.201.169.69 #$IPT -t nat -A PREROUTING -d 200.201.173.68 -p tcp --dport 80 -j DNAT --to 200.201.173.68 #$IPT -t nat -A PREROUTING -d 200.201.174.202 -p tcp -m tcp --dport 80 -j DNAT --to-destination 200.201.174.202:80 #$IPT -t nat -A PREROUTING -d 200.201.174.203 -p tcp -m tcp --dport 80 -j DNAT --to-destination 200.201.174.203:80 #$IPT -t nat -A PREROUTING -d 200.201.174.204 -p tcp -m tcp --dport 80 -j DNAT --to-destination 200.201.174.204:80 #$IPT -t nat -A PREROUTING -d 200.201.174.205 -p tcp -m tcp --dport 80 -j DNAT --to-destination 200.201.174.205:80 #$IPT -t nat -A PREROUTING -d 200.201.174.206 -p tcp -m tcp --dport 80 -j DNAT --to-destination 200.201.174.206:80 #$IPT -t nat -A PREROUTING -d 200.201.174.207 -p tcp -m tcp --dport 80 -j DNAT --to-destination 200.201.174.207:80 #$IPT -t nat -A PREROUTING -d 200.201.174.208 -p tcp -m tcp --dport 80 -j DNAT --to-destination 200.201.174.208:80 #$IPT -t nat -A PREROUTING -d 200.201.174.209 -p tcp -m tcp --dport 80 -j DNAT --to-destination 200.201.174.209:80 #--------- # Regras para acesso direto aos servidores da CNett #--------- #$IPT -t nat -A PREROUTING -d $V01 -j ACCEPT #$IPT -t nat -A PREROUTING -d $V02 -j ACCEPT #--------- # Mascara todas as redes nao roteaveis # que passam por este servidor #--------- #$IPT -t nat -A POSTROUTING -s $EMS_LOCAL -j MASQUERADE # NTP server #$IPT -t nat -A POSTROUTING -d 146.164.53.65 -j MASQUERADE #--------- # Habilita o sistema de cache com TPROXY #--------- /etc/firewall/squid FIREWALL-SQUID #!/bin/bash IP="/sbin/ip" IPT="/sbin/iptables" PROXY_PT="3128" PROXY_MK="1" #---------- # Declara redes utilizadas por este cache #---------- V01="200.163.208.0/30" # rede roteador/qos V02="200.163.208.4/30" # rede qos/mail #---- # Criando as regras de redicionamento dos pacotes # marcados pelo iptables #---- $IP rule add fwmark $PROXY_MK lookup 100 $IP route add local 0.0.0.0/0 dev lo table 100 #---- # Criando as regras do iptables #---- $IPT -t mangle -F $IPT -t mangle -N DIVERT $IPT -t mangle -A PREROUTING -p tcp -m socket -j DIVERT $IPT -t mangle -A DIVERT -j MARK --set-mark 1 $IPT -t mangle -A DIVERT -j ACCEPT #---------- # Regras para funcionamento do Conectividade Social da CEF #---------- $IPT -t mangle -A PREROUTING -d 200.201.166.100 -j ACCEPT $IPT -t mangle -A PREROUTING -d 200.201.169.69 -j ACCEPT $IPT -t mangle -A PREROUTING -d 200.201.173.68 -j ACCEPT $IPT -t mangle -A PREROUTING -d 200.201.174.202 -j ACCEPT $IPT -t mangle -A PREROUTING -d 200.201.174.203 -j ACCEPT $IPT -t mangle -A PREROUTING -d 200.201.174.204 -j ACCEPT $IPT -t mangle -A PREROUTING -d 200.201.174.205 -j ACCEPT $IPT -t mangle -A PREROUTING -d 200.201.174.206 -j ACCEPT $IPT -t mangle -A PREROUTING -d 200.201.174.207 -j ACCEPT $IPT -t mangle -A PREROUTING -d 200.201.174.208 -j ACCEPT $IPT -t mangle -A PREROUTING -d 200.201.174.209 -j ACCEPT #--------- # Regras para acesso direto aos servidores da CNett #--------- $IPT -t mangle -A PREROUTING -d $V01 -j ACCEPT $IPT -t mangle -A PREROUTING -d $V02 -j ACCEPT #---- # Marca os pacotes com destino ao cache #---- $IPT -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port $PROXY_PT So this is doing the redirect stuff into cache (my cache.log is growing fast). I have this config into my squid.conf: http_port 3128 transparent tproxy icp_port 0 cache_mem 64 MB cache_swap_low 92 cache_swap_high 96 maximum_object_size 102400 KB cache_replacement_policy heap LFUDA memory_replacement_policy heap LFUDA cache_dir aufs /cache/00 25000 16 256 cache_dir aufs /cache/01 25000 16 256 cache_dir aufs /cache/02 25000 16 256 cache_dir aufs /cache/03 25000 16 256 cache_store_log none access_log /usr/local/squid/var/logs/access.log squid client_netmask 255.255.255.255 ftp_user squid(a)cnett.com.br diskd_program /usr/local/squid/libexec/diskd unlinkd_program /usr/local/squid/libexec/unlinkd error_directory /usr/local/squid/share/errors/Portuguese dns_nameservers 127.0.0.1 200.163.208.6 dns_testnames www.uol.com.br www.terra.com.br www.cnett.com.br acl manager proto cache_object acl google dstdomain .google.com .orkut.com acl youtube dstdomain .youtube.com acl localhost src 127.0.0.1/32 acl to_localhost dst 127.0.0.0/8 acl QUERY urlpath_regex cgi-bin \? acl SSL_ports port 443 acl Safe_ports port 80 21 443 70 210 280 488 591 777 1025-65535 acl CONNECT method CONNECT acl EMS_PPP_01 src 201.35.16.128/25 acl EMS_NRT_01 src 192.168.40.0/24 acl EMA_PPP_01 src 201.35.16.0/25 acl ELJ_PPP_01 src 200.101.166.0/24 acl V01 src 200.163.208.0/25 http_access allow EMS_PPP_01 http_access allow EMS_NRT_01 http_access allow EMA_PPP_01 http_access allow ELJ_PPP_01 http_access allow V01 http_access allow manager localhost http_access deny manager http_access allow localhost http_access allow to_localhost cache allow google cache allow youtube cache deny QUERY http_access deny !Safe_ports http_access deny CONNECT !SSL_ports http_access deny all icp_access deny all cache_mgr suporte(a)cnett.com.br cache_effective_user squid cache_effective_group squid visible_hostname cache.cnett.com.br unique_hostname cache.cnett.com.br Hope to have some help... -- Att, NATANIEL KLUG nata(a)cnett.com.br LEIA O DIA-A-DIA DO NATA http://nataklug.blogspot.com/ Cyber Nett - Internet Banda Larga www.cnett.com.br (42) 3635-2957 Rua Diogo Pinto, 1046, Centro Laranjeiras do Sul - PR Brasil - 85301-290 "... também os sábios possuem coração tangível e podem, por vezes, usar da ciência como meio de demonstrar impressões sentimentais de que muitos não os julgam suscetíveis." Visconde de Taunay

1 0

TPROXY and network layout
by Nataniel Klug 26 Jun '08

26 Jun '08

Hello my friends, I have a new question about TPROXY. I have not put the tproxy+squid cache into work yet becouse I have this question. Lets talk about my layout plan: [router]0<<>>0[linux.qos]1<<>>0[linux.tproxy.cache]1<<>>X[clients] So, about ip and routes: [router]0 IP: 200.xxx.208.1 Netmask: 255.255.255.252 route add -net 200.xxx.208.4/32 gw 200.xxx.208.2 0[linux.qos] IP: 200.xxx.208.2 Netmask: 255.255.255.252 GW: 200.xxx.208.1 [linux.qos]1 IP: 172.16.0.1 Netmask: 255.255.255.252 route add -net 200.xxx.208.4/32 gw 172.16.0.2 0[linux.tproxy.cache] IP: 172.16.0.2 Netmask: 255.255.255.252 GW: 172.16.0.1 [linux.tproxy.cache]1 IP: 200.xxx.208.5 Netmask: 255.255.255.252 X[clients] IP: 200.xxx.208.6 Netmask: 255.255.255.252 GW: 200.xxx.208.5 Using this layout I can provide full access to the client listed. If I use an iptables rule and squid in transparent mode (not tproxy) it is cached normal. My question is: Using tproxy is that necessary that my cache server has an ip that can be reached from the outside world or can it be only made a masquerade into server QOS? -- Att, NATANIEL KLUG nata(a)cnett.com.br LEIA O DIA-A-DIA DO NATA http://nataklug.blogspot.com/ Cyber Nett - Internet Banda Larga www.cnett.com.br (42) 3635-2957 Rua Diogo Pinto, 1046, Centro Laranjeiras do Sul - PR Brasil - 85301-290 "... também os sábios possuem coração tangível e podem, por vezes, usar da ciência como meio de demonstrar impressões sentimentais de que muitos não os julgam suscetíveis." Visconde de Taunay

1 0

question on menuconfig
by Jeffrey 'jf' Lim 25 Jun '08

25 Jun '08

Hi, folks, I've got my kernel source patched and ready to go, and I'm just about to do the configure, but try as I might, I cant seem to locate everything that's mentioned in the README... <quote> then enable tproxy support, `socket' and `TPROXY' modules </quote> Couple of questions: 1. I've think I've found "enable tproxy support", but this is enabled as a module. So is the "enable tproxy support" any different from the "TPROXY module"? 2. where do I go to enable the socket module? Don't see that anywhere. thanks, -jf -- In the meantime, here is your PSA: "It's so hard to write a graphics driver that open-sourcing it would not help." -- Andrew Fear, Software Product Manager, NVIDIA Corporation http://kerneltrap.org/node/7228

2 2

any version number for tproxy?
by Jeffrey 'jf' Lim 25 Jun '08

25 Jun '08

just curious, but is there like some kind of a version number for tproxy? Saw a "tproxy-4.0" directory under "legacy" in downloads ( http://www.balabit.com/downloads/files/tproxy/obsolete/) but no mention of anything on the main page, nor readme, nor the files in the patch (well, not exactly but.. unless it's "1.5.2.5"?) -jf -- In the meantime, here is your PSA: "It's so hard to write a graphics driver that open-sourcing it would not help." -- Andrew Fear, Software Product Manager, NVIDIA Corporation http://kerneltrap.org/node/7228

3 5

iptables make error with cttproxy
by Ritter, Nicholas 24 Jun '08

24 Jun '08

I am attempting to build iptables 1.3.5 (as bundled with centos 5.1 x86_64) with cttproxy 2.6.18-2.0.6. When compiling iptables, I get an error during libipt_TPROXY_sh.o: cc -shared -o extensions/libipt_TPROXY.so extensions/libipt_TPROXY_sh.o extensions/libipt_TPROXY_sh.o: In function '_init': libipt_TPROXY.c: (.text+0x10): multiple definition of '_init' /usr/lib/gcc/x86_64-redhat-linux/4.1.2/../../../../lib64/crti.o:(.init+0 x0): first defined here collect2: ld returned 1 exit status make: *** [extensions/libipt_TPROXY.so] Error 1 What should I do to fix this? (I am the centOS kernel src v2.6.18, squid 2.6stable20) Nick

2 1

Configuring Squid + TPROXY using iptables 1.4
by Nataniel Klug 20 Jun '08

20 Jun '08

People, After a long time waiting to implement this solution I came here to ask how can I configure the redirection from iptables to squid. My squid.conf has this line: /http_port 3128 tproxy/ It starts ok. For a test I have made this "transparent" and make a rule on iptables (iptables -t nat -A PREROUTING -s .... -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128) and it works fine. It is really getting stuff and putting into cache (TCP_HIT). So, my network layout (for testing purpose only) is: /[ internet ] --- [ router ] --- [ cache ] --- [ me ] "me" network: 10.0.0.0/24 (me = .2 and cache = .1) "cache" network: 192.168.1.0/24 (cache = .9 and router = .1)/ This is a fine layout to work as a transparent proxy (using transparent). My router make a route to 10.0.0.0/24 throu cache, like: /route add -net 10.0.0.0/24 gw 192.168.1.9/ And in this router I am masquerading this network. I don't know if in this layout I can make this work so, I have made this script (based on README from tproxy): ------------------------------------------------------------------------ /#!/bin/bash IP="/sbin/ip" IPT="/sbin/iptables" PROXY_PT="3128" PROXY_MK="1" #---- # Criando as regras de redicionamento dos pacotes # marcados pelo iptables #---- $IP rule add fwmark $PROXY_MK lookup 100 $IP route add local 0.0.0.0/0 dev lo table 100 #---- # Criando as regras do iptables #---- $IPT -t mangle -F $IPT -t mangle -N DIVERT $IPT -t mangle -A PREROUTING -p tcp -m socket -j DIVERT $IPT -t mangle -A DIVERT -j MARK --set-mark 1 $IPT -t mangle -A DIVERT -j ACCEPT #---- # Marca os pacotes com destino ao cache #---- $IPT -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port $PROXY_PT/ ------------------------------------------------------------------------ This script is running as the box boots. When I start the cache it works fine but when I try to open a website squid access.log shows this: ------------------------------------------------------------------------ /1213980761.622 0 10.0.0.2 NONE/400 1497 GET /mrtg/trafego.php - NONE/- text/html 1213980783.535 0 10.0.0.2 NONE/400 1465 GET / - NONE/- text/html 1213980783.654 0 10.0.0.2 NONE/400 1487 GET /favicon.ico - NONE/- text/html 1213980794.052 0 10.0.0.2 NONE/400 1465 GET / - NONE/- text/html 1213980794.661 0 10.0.0.2 NONE/400 1465 GET / - NONE/- text/html 1213980795.181 0 10.0.0.2 NONE/400 1465 GET / - NONE/- text/html 1213980906.136 0 10.0.0.2 NONE/400 1465 GET / - NONE/- text/html/ ------------------------------------------------------------------------ And in my browser show that the URL could not be recovered and its URL is invalid. What can I do to solve this problem? -- Att, NATANIEL KLUG nata(a)cnett.com.br LEIA O DIA-A-DIA DO NATA http://nataklug.blogspot.com/ Cyber Nett - Internet Banda Larga www.cnett.com.br (42) 3635-2957 Rua Diogo Pinto, 1046, Centro Laranjeiras do Sul - PR Brasil - 85301-290 "... também os sábios possuem coração tangível e podem, por vezes, usar da ciência como meio de demonstrar impressões sentimentais de que muitos não os julgam suscetíveis." Visconde de Taunay

1 1