- tproxy - lists.balabit.hu

tproxy + squid 3 + kernel 2.6.25 + iptables 1.4.0
by Nataniel Klug 20 Jun '08

20 Jun '08

Hello guys, I am having serius problems on putting this system to run. My system is: CentOS v5.1 (like Red Hat Enterprises) Kernel 2.6.25 - compiled with this patches: - http://www.balabit.com/downloads/files/tproxy/tproxy-kernel-2.6.25-20080519… - http://ufpr.dl.sourceforge.net/sourceforge/l7-filter/netfilter-layer7-v2.18… Iptables 1.4.0 - compiled with this patches: - http://ufpr.dl.sourceforge.net/sourceforge/l7-filter/netfilter-layer7-v2.18… - wget http://www.balabit.com/downloads/files/tproxy/tproxy-iptables-1.4.0-2008052… - wget http://www.balabit.com/downloads/files/tproxy/tproxy-iptables-20080204-1915… All tproxy patchs I have get from: http://www.balabit.com/downloads/files/tproxy/ When I tryed to use iptables it works just fine with TPROXY rules. So it is ok to work. Now I want to compile Squid: Squid source: http://www.squid-cache.org/Versions/v3/3.0/squid-3.0.STABLE6.tar.gz I used this command line to configure: ./configure *--enable-linux-tproxy *--with-large-files --with-filedescriptors=16384 --enable-storeio=aufs,coss,diskd,ufs --enable-poll --enable-delay-pools --enable-htcp --enable-carp --with-pthreads --enable-underscores --enable-external --enable-arp-acl During the process it came with this message: checking for linux/netfilter_ipv4.h... yes checking for linux/netfilter_ipv4/ip_tproxy.h... no ... checking if TPROXY header files are installed... no WARNING: Cannot find TPROXY headers, you need to install the tproxy package from: - lynx http://www.balabit.com/downloads/tproxy/ I have come into /usr/src/linux and found a xt_TPROXY.h file under netfilter directory but NO ip_tproxy.h. Here is the problem. After all squid compilation it is installed but when I try to use: http_port 3128 transparent tproxy It returns an error. What can I do to solve this problem? -- Att, NATANIEL KLUG nata(a)cnett.com.br LEIA O DIA-A-DIA DO NATA http://nataklug.blogspot.com/ Cyber Nett - Internet Banda Larga www.cnett.com.br (42) 3635-2957 Rua Diogo Pinto, 1046, Centro Laranjeiras do Sul - PR Brasil - 85301-290 "... também os sábios possuem coração tangível e podem, por vezes, usar da ciência como meio de demonstrar impressões sentimentais de que muitos não os julgam suscetíveis." Visconde de Taunay

5 20

--on-port issues
by Ritter, Nicholas 18 Jun '08

18 Jun '08

I noticed in a search of the list going back that others reported problems with cttproxy, iptables 1.3, and an error from iptables concerning the invalid arguement of '--on-port'. I don't recall finding and resolutions. I apply the cttproxy patch and the patch applies with no problems, builds with no problems, but insmod refuses to load the module, and I suspect that the failure to load the module is why I am getting the --on-port related errors. Any thoughts on how to fix this?

1 0

CentOS 5.1 and Tproxy4
by Mike Adkins 11 Jun '08

11 Jun '08

Hello everyone. Setup: CentOS 5.1 Kernel: Linux centos5.a3rocks.com 2.6.25.5 #1 SMP Sun Jun 8 11:15:19 EDT 2008 i686 athlon i386 GNU/Linux tproxy patch: tproxy-kernel-2.6.25-20080519-165031-1211208631.tar.bz2 iptables: 1.4 iptables patch: tproxy-iptables-1.4.0-20080521-113954-1211362794.patch I think everything went well on the patching of the kernel and patching of iptables. So here is where I am. I am using the latest version of haproxy, which should work. I think the issue that I am having is due to the iptables. I don't think iptables is letting haproxy connect to the secondary host server. So haproxy is listening on port 50080, which is where I have tproxy sitting. Please take a look at my iptables entry and tell me if I am missing anything. I can see that my connection hits the proxy server, but it does not relay to the secondary host. Here is my iptables: echo 1 > /proc/sys/net/ipv4/ip_forward /usr/local/sbin/iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 50080 ip rule add fwmark 1 lookup 100 ip route add local 0.0.0.0/0 dev lo table 100 /usr/local/sbin/iptables -t mangle -N DIVERT /usr/local/sbin/iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT /usr/local/sbin/iptables -t mangle -A DIVERT -j MARK --set-mark 1 /usr/local/sbin/iptables -t mangle -A DIVERT -j ACCEPT The ip for the proxy, where tproxy is sitting is 192.168.0.4 and the host server(running IIS) is 192.1680.06. I would like to use squid, but I am not familiar with it, like I am with haproxy. Any info would be appreciated. I am stuck now. Thanks. Mike

2 1

squid 3 and tproxy: no netfilter?
by Ritter, Nicholas 10 Jun '08

10 Jun '08

Am I understanding correctly that when using iptables v1.4, and squid 3 HEAD, that squid does NOT need the netfilter option specified at config time before build? Nick

1 0

IP_TRANSPARENT
by felipecruxen＠turboseg.com.br 09 Jun '08

09 Jun '08

Hi, hi, hi little droogies I've patched a 2.6.24 kernel with tproxy-kernel-2.6.24-20080602 -165651-1212418611.tar.bz2 and downloaded squid 3.1, wich includes the tproxy4 patch. Using Slackware 12 here. Just installed everything, but, when I start squid this message comes up: WARNING: comm_open: setsockopt(IP_TRANSPARENT) not supported on this platform What does that mean? Something went wrong? This squid installation is still usable? Can I ignore this and move forward patching iptables and implementing tproxy4? Thanks in advance, Felipe Cruxen Godinho

2 3

Iptables rules
by Ritter, Nicholas 03 Jun '08

03 Jun '08

What exactly are the redirection rules for wccp/iptables 1.4/squid 2.6/tproxy look like? I have browsed the Internet plus messed with it for a while now and found that the README rules don't fully work, and the examples on the Internet don't fully work. Symptomatically, I see the router redirecting via the GRE tunnel, the squid box sees the gre packets (2.6 kernel), but ifconfig does not show the GRE interface counters incrementing, and the squid service run in debug mode shows no transactions. Something is wrong with either my iptables rules or my GRE tunnel setup. I don't think it is the GRE tunnel because I set it up the same exact was as I did the non-tproxy squid boxes that I have in the same setup which are working. Any help would be a appreciated. I can provide my rule setup, etc. if needed. My knowledge and direct interaction is limited with iptables, which is one more reason why I think the problem is there. BTW - my system log does show the tproxy module loading. Nick

3 2

SQUID 3.1 and TPROXY
by Anton 03 Jun '08

03 Jun '08

Dear Laszlo, Just a little confulsed with your statement (below) on the squid 3.1 wiki - does that mean that TPROXY in 3.1 is non usable yet? --- from squid wiki - Feature: TPROXY Update "It is not yet finished, the squid proxy doesn't bind to the client's address. Furthermore I think it would be better to have a different option for this, and "tproxy" wouldn't imply this." Regards, Anton.

3 7

iptables setup for Zorp
by Tim Feld 29 May '08

29 May '08

Hi, I am having difficulties to transfer the zorp tutorial iptables setup to the new tproxy version without the tproxy table. This is the setup in iptables-save/restore syntax found at balabit's website (https://www.balabit.com/network-security/zorp-gateway/gpl/tutorial/) *tproxy :PREROUTING ACCEPT :OUTPUT ACCEPT :PRintra - :PRinter - :PRdmz - -A PREROUTING -i IFintra -j PRintra -A PREROUTING -i IFinter -j PRinter -A PREROUTING -i IFdmz -j PRdmz // PRintra chain -A PRintra -p tcp --dport 80 -j TPROXY --on-port 50080 -A PRintra -p tcp --dport 443 -j TPROXY --on-port 50443 -A PRintra -p tcp --dport 21 -j TPROXY --on-port 50021 // PRinter chain -A PRinter -p tcp --dport 80 -j TPROXY --on-port 50080 // PRdmz chain // no services permitted COMMIT *filter :INPUT DENY :FORWARD DENY :OUTPUT ACCEPT :noise - :spoof - :spoofdrop DROP :LOintra - :LOinter - :LOdmz - -A INPUT -j noise -A INPUT -j spoof // permit all traffic initiated by transparent proxies -A INPUT -m tproxy -j ACCEPT // // permit all TCP traffic initiated by local processes, or allowed by rules // below, we don't trust the state match for UDP traffic, they will be handled // by individual rules below. // -A INPUT -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT // permit all loopback traffic -A INPUT -i lo -j ACCEPT -A INPUT -i IFintra -j LOintra -A INPUT -i IFinter -j LOinter -A INPUT -i IFdmz -j LOdmz -A INPUT -j DROP -A FORWARD -j LOG --log-prefix "FORWARD DROP: " -A FORWARD -j DROP // LOintra -A LOintra -p udp --dport 53 -j ACCEPT -A LOintra -p udp --dport 123 -j ACCEPT -A LOintra -p tcp --syn --dport 25 -j ACCEPT -A LOintra -j LOG --log-prefix "LOintra DROP: " -A LOintra -j DROP // LOinter // permit DNS replies, bind is configured to send out DNS packets from this // port. We could also use the state match in our INPUT chain. -A LOinter -p udp -s DNS_SERVERS --dport 53000 -j ACCEPT -A LOinter -p udp -s NTP_SERVERS --dport 123 -j ACCEPT -A LOinter -p tcp --syn --dport 25 -j ACCEPT -A LOinter -j LOG --log-prefix "LOinter DROP: " -A LOinter -j DROP // LOdmz -A LOdmz -p udp --dport 53 -j ACCEPT -A LOdmz -p udp --dport 123 -j ACCEPT -A LOdmz -p tcp --syn --dport 25 -j ACCEPT -A LOdmz -j LOG --log-prefix "LOdmz DROP: " -A LOdmz -j DROP // // noise chain, should drop all packets which need not be logged, // otherwise it should return to the main ruleset // -A noise -p udp --dport 137:139 -j DROP -A noise -j RETURN // // spoof chain, should drop all packets with spoofed source address // otherwise it should return to the main ruleset // -A spoof -i lo -j RETURN -A spoof ! -i lo -s 127.0.0.0/8 -j spoofdrop -A spoof -i IFintra ! -s NETintra -j spoofdrop -A spoof ! -i IFintra -s NETintra -j spoofdrop -A spoof -i IFdmz ! -s NETdmz -j spoofdrop -A spoof ! -i IFdmz -s NETdmz -j spoofdrop -A spoof -j RETURN // -A spoofdrop -j LOG --log-prefix "Spoofed packet: " -A spoofdrop -j DROP COMMIT I tried to do the tproxy table stuff in mangle but did not succeed. All packets are dropped. Apart from that I do not know how to replace -A INPUT -m tproxy -j ACCEPT. I really hope someone can help me. Thanks Tim -- Der GMX SmartSurfer hilft bis zu 70% Ihrer Onlinekosten zu sparen! Ideal für Modem und ISDN: http://www.gmx.net/de/go/smartsurfer

2 1

tproxy for UDP
by Ravi Valmikam 29 May '08

29 May '08

I have a tproxy setup with linux 2.6.24 (Ubuntu 8.04 Hardy) that I have been using successfully for a TCP proxy scenario. When I use the same setup for UDP scenario, I am having trouble with sendto() function. Here is what I am doing: - Create a UDP socket - Set IP_TRANSPARENT flag (19) - Bind to a foreign IP address and port# All of the above steps work OK. "netstat -an" confirms that the udp socket is indeed bound to the foriegn address. However, when I do a sendto() to another host, the sendto() call fails with EINVAL. I have ensured that my code is correct by using the same code with bind() to a local address. It works OK. I did look at the net/socket.c net/ipv4/udp.c and none of the EINVAL scenarios seem to obviously apply. Can someone help me out on this one? Did anyone see this issue before? Thanks Ravi

1 0

iptables, kernel insmod problem
by Ritter, Nicholas 23 May '08

23 May '08

I have a CentOS 5.1 box which I have custom compiled iptables and a kernel on. The version I am using are iptables 1.4.0, kernel 2.6.25.4, and tproxy (specifically: tproxy-iptables-1.4.0-20080521-113954-1211362794.patch, and tproxy-kernel-2.6.25-20080519-165031-1211208631.tar.bz2 ) The problem I am having is that when I issue an iptables command to create a TPROXY rule, itpables errors saying that it can't initialize the TPROXY table. Normal I would assume that I had problems with the patches, compiling, etc. Everything patched cleanly, compiled fine, and installed fine. When I searched, I see the compiled libxt_TPROXY and xt_TPROXY.ko files in iptables build directory and the kernel modules directory. Isnmod xt_TROXY does not work. I must have done something wrong somewhere, can someone offer so suggestions? Nick

2 1