- tproxy - lists.balabit.hu

Trouble getting server side transparency to work
by Ravi Valmikam 22 May '08

22 May '08

I am using the following versions of software: - Ubuntu 8.04 (Linux 2.6.24-14) Base Kernel - tproxy-2.6.24-20080509 patch (tproxy-kernel-2.6.24-20080509-164556-1210344356.tar.bz2) - iptables 1.4.0 (from netfilter.org website) - tproxy-iptables-svn-r7519-20080509-165158-1210344718.patch I am using the following script to setup the tproxy rules. ==================================== ip rule add fwmark 1 lookup 100 ip route add local 0.0.0.0/0 dev lo table 100 iptables -t mangle -N DIVERT iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT iptables -t mangle -A DIVERT -j MARK --set-mark 1 iptables -t mangle -A DIVERT -j ACCEPT iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 50080 ==================================== The host I am using is running as a router with eth0 connected to internet and eth1 connected to LAN. I have small a tcp proxy program running on this host. I enabled IP_TRANSPARENT on both sides (client side and server side). The client side is working wonderfully fine. It accepts connections from the client (otherwise destined to the real server), can read and write packets through the accepted FD. However, I am having trouble with the server side socket. I successfully bound the socket to a foriegn address (client's ip and port 0) and initiated a connection to the real server. The TCP SYN is going out of the box and SYN ACK is coming in. But this SYN ACK does not make it into the socket layer (or atleast my program) and socket stays in SYN_SENT state until time out. Can you please help me with this? It feels so close but ... Thanks Ravi My iptables output looks like this: ====================== Chain PREROUTING (policy ACCEPT) target prot opt source destination DIVERT tcp -- anywhere anywhere socket TPROXY tcp -- anywhere anywhere tcp dpt:www TPROXY redirect 0.0.0.0:50080 mark 0x1/0x1 Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain POSTROUTING (policy ACCEPT) target prot opt source destination Chain DIVERT (1 references) target prot opt source destination MARK all -- anywhere anywhere MARK set 0x1 ACCEPT all -- anywhere anywhere ==================================== My modules listing looks like this: ==================================== xt_tcpudp 4352 1 xt_MARK 3328 1 xt_multiport 4480 0 xt_socket 4224 1 nf_conntrack 67136 1 xt_socket xt_TPROXY 3712 1 nf_defrag_ipv4 3456 2 xt_socket,xt_TPROXY nf_tproxy_core 5376 2 xt_socket,xt_TPROXY,[permanent] x_tables 16388 6 xt_tcpudp,xt_MARK,xt_multiport,xt_socket,xt_TPROXY,ip_tables ====================================

3 3

Couldn't load match `socket':/usr/local/lib/iptables/libipt_socket.so
by Tim Feld 21 May '08

21 May '08

Hi, i am trying to set up tproxy to use zorp. The tproxy and iptables patches were applied cleanly. I configured the kernel to include netfilter_tproxy, netfilter_xt_target_tproxy and netfilter_xt_match_socket as modules. Compile and install ran fine. But when I try the example commands from the readme I get several error messages as if tproxy is not installed at all. For example: iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --on-port 50080 --tproxy-mark 0x1/0x1 returns: iptables v1.4.0: Unknown arg `--on-port' without the port argument: iptables v1.4.0: Unknown arg `--tproxy-mark' without the tproxy-mark argument: iptables v1.4.0: Couldn't load target `TPROXY':/usr/local/lib/iptables/libipt_TPROXY.so: cannot open shared object file: No such file or directory command: iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT returns: iptables v1.4.0: Couldn't load match `socket':/usr/local/lib/iptables/libipt_socket.so: cannot open shared object file: No such file or directory Why is it looking for libipt_TPROXY.so and libipt_socket.so? As far as I know in the newer releases there is just xt_TPROXY respectively xt_socket. My setup: Kernel: (Ubuntu) 2.6.24-16-xen, tried 2.6.24.7 from kernel.org too in case the xen patches cause the trouble tproxy: tproxy-2.6.24-20080509 iptables: 1.4.0 (from netfilter.org) tproxy-iptables-svn-r7519-20080509-165158-1210344718.patch I also tried to build tproxy into the kernel instead of using modules. Building fails in that case with the following message: net/built-in.o: In function `socket_mt': /usr/src/linux-2.6.24.7/net/netfilter/xt_socket.c:60: undefined reference to `nf_conntrack_untracked' make[2]: *** [.tmp_vmlinux1] Error 1 make[1]: *** [sub-make] Error 2 I have attached the network part of both kernel configs. I guess I must be missing something. Any help is greatly appreciated! Tim -- Psssst! Schon vom neuen GMX MultiMessenger gehört? Der kann`s mit allen: http://www.gmx.net/de/go/multimessenger

2 2

Is there a usable TPROXY4+squid+linuxKernel patches?
by Anton VG 20 May '08

20 May '08

Hello! Just confused with some staff and can't find answers myself, decided to finally ask here ;) I'm an old user of -tproxy for over than 3 years now, and used the first -tproxy with SQUID 2.4STABLE5 for a long while before upgrading to squid 2.6stable18 recently - but after a few months of use - I found that -tproxy patched kenel+SQUID2.6STABLE_X influences weirdly (inserts delay up to several seconds!) on the any transit traffic (kernel ip stack???) when it get's hit by certain type of traffic on the proxy-redirect port (I pcap-ed the weird traffic - but did not udertood yet why it has such impact) - and had to disable PROXY entirely on the transit cache and wait for next usable version to try. But still cannot find what version I could try on the production cache... For a 2 last monthes periodically looking at the http://www.balabit.com/downloads/files/tproxy/ frequently saw a newer versions pf patches, but I was never able to cleanly apply any of the patches to any of the corresponding Linux Kernel v 2.6.24 or 2.6.25 and the SQUID-3.0STABLE-X Also even the patch tproxy4-squid-3.0.STABLE4.patch - looks suspicious since does not apply cleanly to any of the SQUID versions 3.0Stable 4 or STABLE5 (below is the patch output) and notes internally to the STABLE6 - which is not yet released (according to the SQUID downloads page) Just please could you point out to the working versions of the tproxy4.1 patches for any of the 2.4.20+ kernels and squid 3.0STABLE_ANY ? Trying patching the kernel - looks I would need corresponding -git development branch - but I'm not so familiar with -git yet. I would be just gratefull if you could point me out to a working versions of patches for TPROXY 4.1 for kernel and squid. Below is my output for trying patching squid Stable4 Kind regards, Anton. -- What i get while trying patching the squid. cacheng:/usr/src/TPROXY4/squid-3.0.STABLE4# patch -p0 < tproxy4-squid-3.0.STABLE4.patch patching file ChangeLog Hunk #1 FAILED at 1. 1 out of 1 hunk FAILED -- saving rejects to file ChangeLog.rej patching file configure.in Reversed (or previously applied) patch detected! Assume -R? [n] y can't find file to patch at input line 83 Perhaps you used the wrong -p or --strip option? The text leading up to this was: -------------------------- | |=== modified file 'doc/release-notes/release-3.0.sgml' |--- doc/release-notes/release-3.0.sgml 2008-04-01 11:51:41 +0000 |+++ doc/release-notes/release-3.0.sgml 2008-04-24 07:39:18 +0000 -------------------------- File to patch: Skip this patch? [y] y Skipping patch. 2 out of 2 hunks ignored patching file src/ACLChecklist.cc patching file src/IPInterception.cc patching file src/IPInterception.h patching file src/cache_cf.cc patching file src/cf.data.pre patching file src/client_side.cc Hunk #1 succeeded at 1792 (offset 2 lines). Hunk #2 FAILED at 1963. Hunk #3 succeeded at 2188 (offset -1 lines). Hunk #4 succeeded at 2705 (offset -1 lines). Hunk #5 succeeded at 3013 (offset -1 lines). Hunk #6 succeeded at 3028 (offset -1 lines). 1 out of 6 hunks FAILED -- saving rejects to file src/client_side.cc.rej patching file src/client_side_request.h patching file src/comm.cc patching file src/fde.h patching file src/forward.cc Hunk #5 succeeded at 833 (offset 2 lines). Hunk #6 FAILED at 870. Hunk #7 succeeded at 1214 (offset -28 lines). 1 out of 7 hunks FAILED -- saving rejects to file src/forward.cc.rej patching file src/forward.h Hunk #1 succeeded at 94 (offset -1 lines). patching file src/globals.h patching file src/http.cc patching file src/structs.h patching file src/tools.cc cacheng:/usr/src/TPROXY4/squid-3.0.STABLE4#

4 14

Tproxy in RHEL 5
by Chandana Weganthale 15 May '08

15 May '08

Hi I needed to install and configure tproxy for my Fedora core 6 and RHEL 5 linux boxes. Squid version is 2.6 stable. Can some body help me to install tproxy for my linux boxes ? Thank you Chandana

1 0

tproxy on ubuntu 8.04 server edition
by chrone 14 May '08

14 May '08

Dear all, I need help on setting tproxy with squid2.6stable18 so that I can set the squidbox to forward client ip source address to mikrotik routeros using the client ip source address not the squidbox ip address. I already patch the kernel 2.6.24 with newest tproxy-kernel. but i didn't know how to go on after the patches. I'm sorry for this foolish question, since I'm really newbie in networking. -- everytime i get ahead, i feel more dead.

1 0

what is a status of the SQUID (2.6 STABLE) patch
by NTPT 11 May '08

11 May '08

Hi. I find on the squid homepage about squid 2.6 patchh for tproxy4 "It is not yet finished, the squid proxy doesn't bind to the client's address." with link to patch from balabit site. what is a current status of the tproxy4 patch for 2.6.x-STABLE branch of squid ? ie full functionality etc ?

1 0

tproxy 4.1 releases (2008-05-09)
by Laszlo Attila Toth 09 May '08

09 May '08

Hello, The latest TProxy patchset is available for kernel 2.6.24 and 2.6.25 at http://www.balabit.com/downloads/files/tproxy/ Now it has official Squid support (in 3.1) For details see the README file: http://www.balabit.com/downloads/files/tproxy/README -- Panther

1 0

Compile error in 2.6.24
by NTPT 09 May '08

09 May '08

I try to use tproxy for kernel 2.6.24 , I ended with compile time error Any ide a how to fix ? I am not a C programmer. In file included from include/net/inet_sock.h:27, from include/net/ip.h:30, from fs/lockd/svc.c:35: include/net/route.h: In function 'ip_route_connect': include/net/route.h:161: error: implicit declaration of function 'inet_sk' include/net/route.h:161: error: invalid type argument of '->' In file included from include/net/ip.h:30, from fs/lockd/svc.c:35: include/net/inet_sock.h: At top level: include/net/inet_sock.h:153: error: conflicting types for 'inet_sk' include/net/route.h:161: error: previous implicit declaration of 'inet_sk' was here make[2]: *** [fs/lockd/svc.o] Error 1 make[1]: *** [fs/lockd] Error 2 make: *** [fs] Error 2 Please note that I use tproxy for kernel 2.6.24 because there is no IMQ available for 2.6.25 yet thanx for help

3 4

Tproxy, SQUID, NAT and IMQ on same box ?
by NTPT 05 May '08

05 May '08

Is it posssible to setup TPROXY, SQUID, NAT and IMQ on the same box ? I need to have squid transparent proxy on the SAME box where traffic shaping with IMQ and NAT is done ? Anny suggestions, known working versions etc ? Thanx for help.

3 6

TPROXY but without bridging?
by Wickus Botha - MWEB 09 Apr '08

09 Apr '08

System Layout: Cisco 7200 with wccpv2 Dell 2950 with 1 ethernet interface Kernel: Linux cache 2.6.25-rc6 #1 SMP Tue Apr 8 17:19:10 SAST 2008 i686 i686 i386 GNU/Linux Patch tproxy-kernel-2.6.25-rc6.20080402-130957-1207134597.patch had to fix a few rej. Squid: Squid Cache version 3.HEAD-CVS from cvs Patch http://www.balabit.com/downloads/files/tproxy/tproxy-squid-3_20080408.pa tch Few rej but they were resolved. Configs: echo 1 > /proc/sys/net/ipv4/ip_forward echo 1 > /proc/sys/net/ipv4/ip_nonlocal_bind echo 0 > /proc/sys/net/ipv4/conf/all/rp_filter iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --on-port 3128 --tproxy-mark 0x1/0x1 iptables -t mangle -N DIVERT iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT iptables -t mangle -A DIVERT -p tcp -j MARK --set-mark 1 iptables -t mangle -A DIVERT -j ACCEPT ip rule add fwmark 1 lookup 100 ip route add local 0.0.0.0/0 dev lo table 100 [root@cache com]# iptables -L -v -t mangle Chain PREROUTING (policy ACCEPT 34018 packets, 3155K bytes) pkts bytes target prot opt in out source destination 13 676 TPROXY tcp -- any any anywhere anywhere tcp dpt:http TPROXY redirect 0.0.0.0:3128 mark 0x1/0x1 285 20188 DIVERT tcp -- any any anywhere anywhere socket Chain INPUT (policy ACCEPT 110K packets, 8097K bytes) pkts bytes target prot opt in out source destination Chain FORWARD (policy ACCEPT 10466 packets, 553K bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 144K packets, 28M bytes) pkts bytes target prot opt in out source destination Chain POSTROUTING (policy ACCEPT 151K packets, 28M bytes) pkts bytes target prot opt in out source destination Chain DIVERT (1 references) pkts bytes target prot opt in out source destination 285 20188 MARK tcp -- any any anywhere anywhere MARK set 0x1 285 20188 ACCEPT all -- any any anywhere anywhere [root@cache com]# ip rule list 0: from all lookup local 32765: from all fwmark 0x1 lookup 100 32766: from all lookup main 32767: from all lookup default [root@cache com]# ip route list table 100 local default dev lo scope host [root@cache com]# Squid Startup: squid -f /etc/squid.conf -d 9 -N 2008/04/09 07:32:46| Starting Squid Cache version 3.HEAD-CVS for i686-pc-linux-gnu... 2008/04/09 07:32:46| Process ID 11754 2008/04/09 07:32:46| With 1024 file descriptors available 2008/04/09 07:32:46| Performing DNS Tests... 2008/04/09 07:32:47| Successful DNS name lookup tests... 2008/04/09 07:32:47| DNS Socket created at 0.0.0.0, FD 5 2008/04/09 07:32:47| Adding nameserver 196.22.160.63 from squid.conf 2008/04/09 07:32:47| Unlinkd pipe opened on FD 10 2008/04/09 07:32:47| Store logging disabled 2008/04/09 07:32:47| Swap maxSize 512000000 KB, estimated 39384615 objects 2008/04/09 07:32:47| Target number of buckets: 1969230 2008/04/09 07:32:47| Using 2097152 Store buckets 2008/04/09 07:32:47| Max Mem size: 614400 KB 2008/04/09 07:32:47| Max Swap size: 512000000 KB 2008/04/09 07:32:47| Version 1 of swap file with LFS support detected... 2008/04/09 07:32:47| Rebuilding storage in /CACHE1 (CLEAN) 2008/04/09 07:32:47| Version 1 of swap file with LFS support detected... 2008/04/09 07:32:47| Rebuilding storage in /CACHE2 (CLEAN) 2008/04/09 07:32:47| Version 1 of swap file with LFS support detected... 2008/04/09 07:32:47| Rebuilding storage in /CACHE3 (CLEAN) 2008/04/09 07:32:47| Version 1 of swap file with LFS support detected... 2008/04/09 07:32:47| Rebuilding storage in /CACHE4 (CLEAN) 2008/04/09 07:32:47| Version 1 of swap file with LFS support detected... 2008/04/09 07:32:47| Rebuilding storage in /CACHE5 (CLEAN) 2008/04/09 07:32:47| Using Least Load store dir selection 2008/04/09 07:32:47| Set Current Directory to /usr/local/squid/var/cache 2008/04/09 07:32:47| Loaded Icons. 2008/04/09 07:32:47| Accepting transparently proxied HTTP connections at 0.0.0.0:3128, FD 21. 2008/04/09 07:32:47| Accepting ICP messages at 0.0.0.0:3130, FD 22. 2008/04/09 07:32:47| HTCP Disabled. 2008/04/09 07:32:47| Accepting WCCPv2 messages on port 2048, FD 23. 2008/04/09 07:32:47| Initialising all WCCPv2 lists 2008/04/09 07:32:47| ICMPSquid.cc(252) Open: Pinger socket opened on FD 25 2008/04/09 07:32:47| ICMPSquid.cc(125) SendEcho: Wrote 33 of 33 bytes 2008/04/09 07:32:47| Ready to serve requests. 2008/04/09 07:32:47| Store rebuilding is 8.08% complete 2008/04/09 07:32:49| Done reading /CACHE3 swaplog (48442 entries) 2008/04/09 07:32:49| Done reading /CACHE4 swaplog (48580 entries) 2008/04/09 07:32:49| Done reading /CACHE1 swaplog (50685 entries) 2008/04/09 07:32:49| Done reading /CACHE2 swaplog (56017 entries) 2008/04/09 07:32:49| Done reading /CACHE5 swaplog (59238 entries) 2008/04/09 07:32:49| Finished rebuilding storage from disk. 2008/04/09 07:32:49| 262962 Entries scanned 2008/04/09 07:32:49| 0 Invalid entries. 2008/04/09 07:32:49| 0 With invalid flags. 2008/04/09 07:32:49| 262962 Objects loaded. 2008/04/09 07:32:49| 0 Objects expired. 2008/04/09 07:32:49| 0 Objects cancelled. 2008/04/09 07:32:49| 0 Duplicate URLs purged. 2008/04/09 07:32:49| 0 Swapfile clashes avoided. 2008/04/09 07:32:49| Took 1.75 seconds (150574.61 objects/sec). 2008/04/09 07:32:49| Beginning Validation Procedure 2008/04/09 07:32:49| 262144 Entries Validated so far. 2008/04/09 07:32:49| Completed Validation Procedure 2008/04/09 07:32:49| Validated 525949 Entries 2008/04/09 07:32:49| store_swap_size = 9901896 2008/04/09 07:32:49| storeLateRelease: released 0 objects WCCPV2 Setup interface GigabitEthernet0/1.777 ip wccp 80 redirect out ip wccp 90 redirect in ! Gre Tunnel setup ip tunnel add wccp mode gre remote 196.28.112.1 local 196.28.38.73 dev eth0 ifconfig wccp 196.28.38.73 netmask 255.255.255.240 up Squid config: acl 196.22.160.0-19 src 196.22.160.0/19 acl TEST src 196.28.112.0/20 acl manager proto cache_object acl localhost src 127.0.0.1/32 acl to_localhost dst 127.0.0.0/8 acl localnet src 10.0.0.0/8 # RFC1918 possible internal network acl localnet src 172.16.0.0/12 # RFC1918 possible internal network acl localnet src 192.168.0.0/16 # RFC1918 possible internal network acl SSL_ports port 443 acl Safe_ports port 80 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 # https acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl CONNECT method CONNECT http_access allow manager localhost http_access deny manager http_access deny !Safe_ports http_access deny CONNECT !SSL_ports http_access allow localnet http_access allow 196.22.160.0-19 http_access allow TEST http_access deny all icp_access allow localnet icp_access deny all htcp_access allow localnet htcp_access deny all http_port 3128 tproxy transparent tcp_outgoing_address 196.28.38.73 hierarchy_stoplist cgi-bin ? cache_mem 600 MB maximum_object_size_in_memory 128 KB cache_dir aufs /CACHE1 100000 16 256 cache_dir aufs /CACHE2 100000 16 256 cache_dir aufs /CACHE3 100000 16 256 cache_dir aufs /CACHE4 100000 16 256 cache_dir aufs /CACHE5 100000 16 256 minimum_object_size 0 KB maximum_object_size 2 GB cache_swap_low 70 cache_swap_high 80 access_log /var/log/squid/access.log squid cache_log /var/log/squid/cache.log cache_store_log none emulate_httpd_log off log_ip_on_direct on debug_options ALL,1 refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern (cgi-bin|\?) 0 0% 0 refresh_pattern . 0 20% 4320 read_ahead_gap 60 KB positive_dns_ttl 24 hours negative_dns_ttl 30 seconds via off ie_refresh on connect_timeout 30 seconds request_timeout 60 seconds half_closed_clients off shutdown_lifetime 5 seconds visible_hostname cache.*.* wccp2_router 196.22.185.38 wccp2_service dynamic 80 password=ci5co wccp2_service_info 80 protocol=tcp flags=src_ip_hash priority=240 ports=80 wccp2_service dynamic 90 password=ci5co wccp2_service_info 90 protocol=tcp flags=dst_ip_hash,ports_source priority=240 ports=80 icp_port 3130 always_direct allow all dns_nameservers 196.22.160.63 ipcache_size 51200 fqdncache_size 51200 memory_pools on forwarded_for off coredump_dir /usr/local/squid/var/cache pipeline_prefetch on With the default iptable rules above I don't see any packets on the destination machine. Ive then started playing around with the settings and add the rules below. iptables -t mangle -A PREROUTING -p tcp --dport 80 -j LOG --log-level 6 --log-prefix "TPROXY : " iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --on-port 3128 --tproxy-mark 0x1/0x1 iptables -t mangle -A PREROUTING -p tcp --sport 80 -j LOG --log-level 6 --log-prefix "TPROXY_SPORT : " iptables -t mangle -A PREROUTING -p tcp --sport 80 -j TPROXY --on-port 3128 --tproxy-mark 0x2/0x2 iptables -t mangle -A POSTROUTING -p tcp --dport 80 -j LOG --log-level 6 --log-prefix "MANGLE_POSTROUTING1 : " iptables -t mangle -A POSTROUTING -p tcp --dport 80 -j ACCEPT These will log to syslog. This is the output I'm seeing on the squid server. Apr 9 08:14:13 cache kernel: MANGLE_PREROUTING : IN=wccp OUT= MAC=45:00:00:58:00:4a:00:00:fd:2f:9e:a9:c4:1c:70:01:c4:1c:26:49:00:00:88 :3e:01:50:00:b1:45:00:00:3c:07:ce:40:00:3f:06 SRC=196.28.113.24 DST=196.22.160.68 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=1998 DF PROTO=TCP SPT=53604 DPT=80 WINDOW=5840 RES=0x00 SYN URGP=0 Apr 9 08:14:13 cache kernel: MANGLE_POSTROUTING1 : IN= OUT=eth0 SRC=196.28.113.24 DST=196.22.160.68 LEN=60 TOS=0x00 PREC=0x00 TTL=62 ID=1998 DF PROTO=TCP SPT=53604 DPT=80 WINDOW=5840 RES=0x00 SYN URGP=0 Apr 9 08:14:13 cache kernel: TPROXY_SPORT : IN=wccp OUT= MAC=45:00:00:50:07:0b:00:00:fd:2f:97:f0:c4:1c:70:01:c4:1c:26:49:00:00:88 :3e:01:5a:00:b1:45:00:00:34:00:00:40:00:3e:06 SRC=196.22.160.68 DST=196.28.113.24 LEN=52 TOS=0x00 PREC=0x00 TTL=62 ID=0 DF PROTO=TCP SPT=80 DPT=53604 WINDOW=5840 RES=0x00 ACK SYN URGP=0 Apr 9 08:14:13 cache kernel: MANGLE_POSTROUTING1 : IN= OUT=eth0 SRC=196.28.113.24 DST=196.22.160.68 LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=TCP SPT=53604 DPT=80 WINDOW=0 RES=0x00 RST URGP=0 This is a tcpdump on the destination machine 08:15:30.278021 196.28.113.24.53604 > 196.22.160.68.80: S 3782047292:3782047292(0) win 5840 <mss 1452,sackOK,timestamp 817000946 0,nop,wscale 4> (DF) 08:15:30.278079 196.22.160.68.80 > 196.28.113.24.53604: S 718132722:718132722(0) ack 3782047293 win 5840 <mss 1460,nop,nop,sackOK,nop,wscale 0> (DF) 08:15:30.278775 196.28.113.24.53604 > 196.22.160.68.80: R 3782047293:3782047293(0) win 0 (DF) My squid servers ip address is 196.28.38.73. Client ip is 196.28.113.24 Destination ip is 196.22.160.68. Can somebody please tell me if I'm right with the following statements. Packet comes in on interface wccp gre tunnel from router. With the src and dst address. Apr 9 08:14:13 cache kernel: MANGLE_PREROUTING : IN=wccp OUT= MAC=45:00:00:58:00:4a:00:00:fd:2f:9e:a9:c4:1c:70:01:c4:1c:26:49:00:00:88 :3e:01:50:00:b1:45:00:00:3c:07:ce:40:00:3f:06 SRC=196.28.113.24 DST=196.22.160.68 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=1998 DF PROTO=TCP SPT=53604 DPT=80 WINDOW=5840 RES=0x00 SYN URGP=0 Packet leaves on interface eth0 with the clients ip as source address. Apr 9 08:14:13 cache kernel: MANGLE_PREROUTING : IN=wccp OUT= MAC=45:00:00:58:00:4a:00:00:fd:2f:9e:a9:c4:1c:70:01:c4:1c:26:49:00:00:88 :3e:01:50:00:b1:45:00:00:3c:07:ce:40:00:3f:06 SRC=196.28.113.24 DST=196.22.160.68 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=1998 DF PROTO=TCP SPT=53604 DPT=80 WINDOW=5840 RES=0x00 SYN URGP=0 Packet comes back via the wccp interface. This time with the destination pc as src and the clients ip as destination. Apr 9 08:14:13 cache kernel: TPROXY_SPORT : IN=wccp OUT= MAC=45:00:00:50:07:0b:00:00:fd:2f:97:f0:c4:1c:70:01:c4:1c:26:49:00:00:88 :3e:01:5a:00:b1:45:00:00:34:00:00:40:00:3e:06 SRC=196.22.160.68 DST=196.28.113.24 LEN=52 TOS=0x00 PREC=0x00 TTL=62 ID=0 DF PROTO=TCP SPT=80 DPT=53604 WINDOW=5840 RES=0x00 ACK SYN URGP=0 I'm pretty sure this is where everything goes dead as the request is sent to the destination server again. If there is anything that I missed or can try to resolve it please let me know. In the mean time I will continue to play with the settings. Keep up the good work. Thanks Wickus

1 0