- tproxy - lists.balabit.hu

tproxy iptables rules
by Kevin Stewart 07 Apr '08

07 Apr '08

I am trying to transparently proxy traffic to specific hosts each listening on a different port. I would like to if at all possible run without having to specifically create iptables rules per host. the important parts of the code are below I listen to an ip:port pair using listento and then once I see an incoming connection attempt to connect to that host using the clients IP:port using connectas. what I am seeing is that I get the client connection then make the outbound connection but that does not have its source changed and its intercepted by the tproxyed listen so I get an loop of incoming connections I have 2 interfaces on my server and plan to run it as a router I bind to 2 the client facing IP for listening and the internet facing IP for connecting out I am using 2.6.20-wolk5.0 from here http://ftp.ticklers.org/ftp.kernel.org/linux/kernel/people/mcp/2.6-WOLK/?C=… the tproxy version is 2.0.6 any help would be greatly appreciated. Kevin int listento(struct sockaddr_in *laddr, struct sockaddr_in *raddr){ int sock; int i; struct in_tproxy itp; struct sockaddr_in sin; sock = socket(AF_INET, SOCK_STREAM, 0); if (sock == -1){ perror("socket"); return -1; } i = 1; if (setsockopt(sock, SOL_IP, SO_REUSEADDR, &i, sizeof(i)) == -1){ perror("SO_REUSEADDR"); return -1; } /* check tproxy version */ itp.op = TPROXY_VERSION; itp.v.version = 0x02000000; if (setsockopt(sock, SOL_IP, IP_TPROXY, &itp, sizeof(itp)) == -1) { perror("setsockopt(SOL_IP, IP_TPROXY, TPROXY_VERSION)"); return -1; } /* bind to local address */ if (bind(sock, (struct sockaddr *) laddr, sizeof(sin)) == -1) { perror("listento: bind"); return -1; } /* assign foreign address */ itp.op = TPROXY_ASSIGN; itp.v.addr.faddr=raddr->sin_addr; itp.v.addr.fport = raddr->sin_port; if (setsockopt(sock, SOL_IP, IP_TPROXY, &itp, sizeof(itp)) == -1) { perror("setsockopt(SOL_IP, IP_TPROXY, TPROXY_ASSIGN)"); return -1; } /* set listen flag */ itp.op = TPROXY_FLAGS; itp.v.flags = ITP_LISTEN; if (setsockopt(sock, SOL_IP, IP_TPROXY, &itp, sizeof(itp)) == -1) { perror("setsockopt(SOL_IP, IP_TPROXY, TPROXY_FLAGS)"); return -1; } /* listen */ if (listen(sock, BACKLOG) == -1) { perror("listen"); return -1; } return sock; } int connectas( struct sockaddr_in *laddr, struct sockaddr_in *faddr, struct sockaddr_in *daddr) { int sock; struct in_tproxy itp; sock = socket(AF_INET, SOCK_STREAM, 0); if (sock == -1){ perror("socket"); return(-1); } /* bind to local address */ if (bind(sock, (struct sockaddr*) laddr, sizeof(*laddr)) == -1){ perror("connectas: bind"); return -1; } /* assign foreign address */ itp.op = TPROXY_ASSIGN; itp.v.addr.faddr=faddr->sin_addr; itp.v.addr.fport=faddr->sin_port; if (setsockopt(sock, SOL_IP, IP_TPROXY, &itp, sizeof(itp)) == -1){ close(sock); printf("errno=%i\n",errno); perror("setsockopt(SOL_IP, IP_TPROXY, TPROXY_ASSIGN)"); return -1; } /* specify peer endpoint: the same address we will pass to connect() */ itp.op = TPROXY_FLAGS; itp.v.flags = ITP_CONNECT | ITP_ONCE; itp.v.addr.faddr=daddr->sin_addr; itp.v.addr.fport=daddr->sin_port; if (setsockopt(sock, SOL_IP, IP_TPROXY, &itp, sizeof(itp)) == -1){ close(sock); printf("errno=%i\n",errno); perror("setsockopt(SOL_IP, IP_TPROXY, TPROXY_FLAGS)"); return -1; } /* connect */ if (connect(sock, (struct sockaddr*) daddr, sizeof(*daddr)) == -1){ close(sock); perror("connect"); return -1; } return sock; }

1 0

Re: [tproxy] TPROXY but without bridging?
by admin＠abp.pl 02 Apr '08

02 Apr '08

Hello Ming-Ching Dnia So Marca 29 2008, 15:30, Ming-Ching Tiew napisał(a): (...) > Well among all things you have at least gotten to patch > the 2.6.25-rc7 kernel. Good ! That's a big step better than > just ***STARE*** at the patch and refuse to use use it and > then start asking all sorts of question about where is the > correct patch ! > Sorry, I thought that clients traffic to squid will be DNATed. Now I know, that with new tproxy it is better to use more inteligent solution. Packets CONNMARKing and change routing tables with "ip rule" and fwmark.Like Henrik Nordstrom said on router0 and routers a,b,c.. iptables -t mangle entires marks http traffic and redirect routing to squid machine. Now squid (patched with tproxy-squid-2.6-STABLE18.20080304-110716-1204625236.patch) cacheing flow but with IP address of Squid ( not clients). Laszlo Attila Toth told that problem is with squid patch. So now we need to ask who is able to fix tproxy-4.1 patch to squid 2.6? I'm right, am I? Regards, Tomasz PS Sorry for my english. > > Until you have become an advance user, may I know > what is stopping you to make the squid box a bridge ? I don't want to have next server between routers. I'm fighting wth DoS attacks (viruses, ect..) and I'm afraid that processor on squid machine may not handle thousands interupts generated during attacks. Beter for me is standalone and more resistant server. On my router0 during "attack" on top I have sometimes over 80-90% of ksoftirqd/0 (I have Intel pci-e 82572EI and 82573V cards). Regards, Tomasz PS. Sorry for my english

2 1

Re: [tproxy] TPROXY but without bridging?
by admin＠abp.pl 01 Apr '08

01 Apr '08

Dnia Wt Kwietnia 1 2008, 10:26, Laszlo Attila Toth napisał(a): > admin(a)abp.pl wrote: >> I wrote bellow my progress in implementation tproxy to work with >> squid-2.6. I have only one problem. >> >> >> --- >> On routers A,B.. (from my topology diagram) >> (eth1 is lan interface) >> >> $BIN_IPT -t mangle -A PREROUTING -i eth1 -m state --state NEW -p tcp >> --dport 80 -j CONNMARK --set-mark 2 >> $BIN_IPT -t mangle -A PREROUTING -i eth1 -j CONNMARK --restore-mark >> >> ip route add table 100 default via [squid_ip] >> ip rule add fwmark 2 lookup 100 >> >> --- >> On router 0: >> (eth1 is lan interface,eth0 wan interface) >> iptables -t mangle -A PREROUTING -i eth1 -m state --state NEW -p tcp >> --dport 80 -j CONNMARK --set-mark 1 >> iptables -t mangle -A PREROUTING -i eth0 -j CONNMARK --restore-mark >> >> --- >> On squid: >> iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY >> --tproxy-mark >> 0x1/0x1 --on-port 3128 >> iptables -t mangle -N DIVERT >> iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT >> iptables -t mangle -A DIVERT -j MARK --set-mark 1 >> iptables -t mangle -A DIVERT -j ACCEPT >> ip rule add fwmark 1 lookup 100 >> ip route add local 0.0.0.0/0 dev lo table 100 >> >> and on squid machine i have also routing entries for all routable >> subclasses from routers a,b,c... >> >> on squid.conf: >> http_port 3128 transparent tproxy >> >> #uname -a >> Linux w3cache 2.6.25-rc7 >> (patched by tproxy-20080227-171356-1204128836.tar.bz2) >> >> I atached also output from dmesg | grep TPROXY. >> >> Squid patched by >> tproxy-squid-2.6-STABLE18.20080304-110716-1204625236.patch >> >> Traffic flows by squid correctly but like you said web servers outside >> network logs connections with ip of squid machine - not clients. Is any >> chance to fix it? > > The latest squid-3 patch solves this problem but I haven't got the same > for squid-2.6. The squid-3 patch is made by Amos Jeffries and I added > two diffs to the end of it (if you see the content). Squid-3 is still worse than squid-2.6 (coss implementation ect..) I didn't see benefits from posibility of migrate to squid-3. So is any chance to quick modify patch for 2.5 version of squid? Regards, -- Tomasz

1 0

Re: [tproxy] TPROXY but without bridging?
by admin＠abp.pl 01 Apr '08

01 Apr '08

Hello, I wrote bellow my progress in implementation tproxy to work with squid-2.6. I have only one problem. --- On routers A,B.. (from my topology diagram) (eth1 is lan interface) $BIN_IPT -t mangle -A PREROUTING -i eth1 -m state --state NEW -p tcp --dport 80 -j CONNMARK --set-mark 2 $BIN_IPT -t mangle -A PREROUTING -i eth1 -j CONNMARK --restore-mark ip route add table 100 default via [squid_ip] ip rule add fwmark 2 lookup 100 --- On router 0: (eth1 is lan interface,eth0 wan interface) iptables -t mangle -A PREROUTING -i eth1 -m state --state NEW -p tcp --dport 80 -j CONNMARK --set-mark 1 iptables -t mangle -A PREROUTING -i eth0 -j CONNMARK --restore-mark --- On squid: iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 3128 iptables -t mangle -N DIVERT iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT iptables -t mangle -A DIVERT -j MARK --set-mark 1 iptables -t mangle -A DIVERT -j ACCEPT ip rule add fwmark 1 lookup 100 ip route add local 0.0.0.0/0 dev lo table 100 and on squid machine i have also routing entries for all routable subclasses from routers a,b,c... on squid.conf: http_port 3128 transparent tproxy #uname -a Linux w3cache 2.6.25-rc7 (patched by tproxy-20080227-171356-1204128836.tar.bz2) I atached also output from dmesg | grep TPROXY. Squid patched by tproxy-squid-2.6-STABLE18.20080304-110716-1204625236.patch Traffic flows by squid correctly but like you said web servers outside network logs connections with ip of squid machine - not clients. Is any chance to fix it? Regards, Tomasz Dnia Pn Marca 31 2008, 16:51, Laszlo Attila Toth napisał(a): > Ming-Ching Tiew wrote: >> admin(a)abp.pl wrote: >>> I'm using Squid Cache: Version 2.6.STABLE18 >>> >>> Is there posibility to use it as fully transprent proxy (with tproxy) >>> but >>> without bridging interfaces? >>> >>> My topology: >>> >>> [router 0]---[Internet] >>> | >>> | >>> [===switch=======================] >>> | | | >>> [squid] [ router a ][ router b ] ..... >>> >>> to routers a,b... are connected clients. On that routers I have DNAT >>> --to-destiation squid:80 >>> >>> On squid machine i have 2.6.25-rc7 kernel and Squid with patches from >>> http://people.balabit.hu/panther/tproxy/. > > The official site is http://www.balabit.com/downloads/files/tproxy/, any > other address is used for development. > > The latest squid patch, for version 3 is the following: > > http://www.balabit.com/downloads/files/tproxy/tproxy-squid-3-20080401.patch > > It is not yet finished (the outgoing packets have the squid's IP address > and not the client's). > >>> >>> And: >>> iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY \ >>> --tproxy-mark 0x1/0x1 -on-port 3128 >>> iptables -t mangle -N DIVERT >>> iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT >>> iptables -t mangle -A DIVERT -j MARK --set-mark 1 >>> iptables -t mangle -A DIVERT -j ACCEPT >>> ip rule add fwmark 1 lookup 100 >>> ip route add local 0.0.0.0/0 dev lo table 100 >>> >>> squid.conf: >>> .. >>> http_port 3128 transparent tproxy > > > In squid.conf use the following: > > http_port 3128 tproxy > > No more change is necessary (except ACL). > >>> >>> When I test this configuration webservers logs connection from clients >>> from routers a,b... with ip of squid machine. So tproxy doesnt' work. >>> >>> Can I fix it? > > The patch doesn't resolve this problem yet, sorry. > >>> >>> PS. It's urgent for me, please help;) >>> Regards, >>> Tomasz >>> >>> >> Well among all things you have at least gotten to patch >> the 2.6.25-rc7 kernel. Good ! That's a big step better than >> just ***STARE*** at the patch and refuse to use use it and >> then start asking all sorts of question about where is the >> correct patch ! >> >> :-) > > ... and for which kernel version. Earlier than 2.6.22 will not be > supported. But I'm not sure which kernels are used because I have to > backport tproxy for them. -- Tomasz Dnia Pn Marca 31 2008, 16:51, Laszlo Attila Toth napisał(a): > Ming-Ching Tiew wrote: >> admin(a)abp.pl wrote: >>> I'm using Squid Cache: Version 2.6.STABLE18 >>> >>> Is there posibility to use it as fully transprent proxy (with tproxy) >>> but >>> without bridging interfaces? >>> >>> My topology: >>> >>> [router 0]---[Internet] >>> | >>> | >>> [===switch=======================] >>> | | | >>> [squid] [ router a ][ router b ] ..... >>> >>> to routers a,b... are connected clients. On that routers I have DNAT >>> --to-destiation squid:80 >>> >>> On squid machine i have 2.6.25-rc7 kernel and Squid with patches from >>> http://people.balabit.hu/panther/tproxy/. > > The official site is http://www.balabit.com/downloads/files/tproxy/, any > other address is used for development. > > The latest squid patch, for version 3 is the following: > > http://www.balabit.com/downloads/files/tproxy/tproxy-squid-3-20080401.patch > > It is not yet finished (the outgoing packets have the squid's IP address > and not the client's). > >>> >>> And: >>> iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY \ >>> --tproxy-mark 0x1/0x1 -on-port 3128 >>> iptables -t mangle -N DIVERT >>> iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT >>> iptables -t mangle -A DIVERT -j MARK --set-mark 1 >>> iptables -t mangle -A DIVERT -j ACCEPT >>> ip rule add fwmark 1 lookup 100 >>> ip route add local 0.0.0.0/0 dev lo table 100 >>> >>> squid.conf: >>> .. >>> http_port 3128 transparent tproxy > > > In squid.conf use the following: > > http_port 3128 tproxy > > No more change is necessary (except ACL). > >>> >>> When I test this configuration webservers logs connection from clients >>> from routers a,b... with ip of squid machine. So tproxy doesnt' work. >>> >>> Can I fix it? > > The patch doesn't resolve this problem yet, sorry. > >>> >>> PS. It's urgent for me, please help;) >>> Regards, >>> Tomasz >>> >>> >> Well among all things you have at least gotten to patch >> the 2.6.25-rc7 kernel. Good ! That's a big step better than >> just ***STARE*** at the patch and refuse to use use it and >> then start asking all sorts of question about where is the >> correct patch ! >> >> :-) > > ... and for which kernel version. Earlier than 2.6.22 will not be > supported. But I'm not sure which kernels are used because I have to > backport tproxy for them.

2 1

Re: [tproxy] TPROXY but without bridging?
by admin＠abp.pl 31 Mar '08

31 Mar '08

Hi Dnia Pn Marca 31 2008, 16:51, Laszlo Attila Toth napisał(a): > Ming-Ching Tiew wrote: >> admin(a)abp.pl wrote: >>> I'm using Squid Cache: Version 2.6.STABLE18 >>> >>> Is there posibility to use it as fully transprent proxy (with tproxy) >>> but >>> without bridging interfaces? >>> >>> My topology: >>> >>> [router 0]---[Internet] >>> | >>> | >>> [===switch=======================] >>> | | | >>> [squid] [ router a ][ router b ] ..... >>> >>> to routers a,b... are connected clients. On that routers I have DNAT >>> --to-destiation squid:80 >>> >>> On squid machine i have 2.6.25-rc7 kernel and Squid with patches from >>> http://people.balabit.hu/panther/tproxy/. > > The official site is http://www.balabit.com/downloads/files/tproxy/, any > other address is used for development. > > The latest squid patch, for version 3 is the following: > > http://www.balabit.com/downloads/files/tproxy/tproxy-squid-3-20080401.patch > > It is not yet finished (the outgoing packets have the squid's IP address > and not the client's). But this patch "tproxy-squid-2.6-STABLE18.20080304-110716-1204625236.patch" isn't working correct? I don't want squid3. I need only one feature, transparent squid with outgoing traffic with client IP addresses. >>> >>> And: >>> iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY \ >>> --tproxy-mark 0x1/0x1 -on-port 3128 >>> iptables -t mangle -N DIVERT >>> iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT >>> iptables -t mangle -A DIVERT -j MARK --set-mark 1 >>> iptables -t mangle -A DIVERT -j ACCEPT >>> ip rule add fwmark 1 lookup 100 >>> ip route add local 0.0.0.0/0 dev lo table 100 >>> >>> squid.conf: >>> .. >>> http_port 3128 transparent tproxy > > > In squid.conf use the following: > > http_port 3128 tproxy > > No more change is necessary (except ACL). > >>> >>> When I test this configuration webservers logs connection from clients >>> from routers a,b... with ip of squid machine. So tproxy doesnt' work. >>> >>> Can I fix it? > > The patch doesn't resolve this problem yet, sorry. :/ So there is no way to transparent proxy clients request on squid 2.6 and kernels above 2.6.22? >>> >>> PS. It's urgent for me, please help;) >>> Regards, >>> Tomasz >>> >>> >> Well among all things you have at least gotten to patch >> the 2.6.25-rc7 kernel. Good ! That's a big step better than >> just ***STARE*** at the patch and refuse to use use it and >> then start asking all sorts of question about where is the >> correct patch ! >> >> :-) > > ... and for which kernel version. Earlier than 2.6.22 will not be > supported. But I'm not sure which kernels are used because I have to > backport tproxy for them. I need kernel newer then 2.6.22, Squid 2.6-stable18 and tproxy-X with full transparent traffic through squid. Regards, -- Tomasz

1 0

TPROXY but without bridging?
by admin＠abp.pl 31 Mar '08

31 Mar '08

Hello, I'm using Squid Cache: Version 2.6.STABLE18 Is there posibility to use it as fully transprent proxy (with tproxy) but without bridging interfaces? My topology: [router 0]---[Internet] | | [===switch=======================] | | | [squid] [ router a ][ router b ] ..... to routers a,b... are connected clients. On that routers I have DNAT --to-destiation squid:80 On squid machine i have 2.6.25-rc7 kernel and Squid with patches from http://people.balabit.hu/panther/tproxy/. And: iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY \ --tproxy-mark 0x1/0x1 -on-port 3128 iptables -t mangle -N DIVERT iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT iptables -t mangle -A DIVERT -j MARK --set-mark 1 iptables -t mangle -A DIVERT -j ACCEPT ip rule add fwmark 1 lookup 100 ip route add local 0.0.0.0/0 dev lo table 100 squid.conf: .. http_port 3128 transparent tproxy tcp_outgoing_address [machine ip] .. When I test this configuration webservers logs connection from clients from routers a,b... with ip of squid machine. So tproxy doesnt' work. Can I fix it? PS. It's urgent for me, please help;) Regards, Tomasz -- Tomasz Kolaj Administrator sieci ABP Computer

3 2

Need Help
by Adnan Shahzad 15 Mar '08

15 Mar '08

Dear Sir, i am working in a company, Pakistan. My Network setting is Squid Machine -------> Packeeter (Hardware for Bandwidth Management (With out NATing)) ---------> F5 (aggreated internet connection (With out NATing) ) --------> Router (NATing) i want to configure Squid with dansguardian for content filter. but problem which i am facing is that squid do NAT and don't forward Client IP. Which i want to forward client IP to Packeeter and squid do cache, log and content filtering job. But i am facing this problem and i study lots of Document and no success so Please guide me and Help me to resolve this problem. looking forward to your positive response. Regards ------------------------------------ M.Adnan Shahzad System Administrator

1 0

tutorial
by Emerson Gregorio 13 Mar '08

13 Mar '08

Good morning! First, sorry for using Google Translator. I am new in the world linux, but with doing some things like compiling kernel. After they discovered the Tproxy and believe that it will help me in my save bandwidth provider of internet and also pass the ip's worth of customers. I have some time trying to work, but could not yet. The documentation that could find is very simple or for advanced users. If anyone can help me and I spend a more detailed tutorial with the options I need to compile the kernel, I doubt that I will achieve the installation. Sincerely,

1 0

openSUSE 10.3 + squid + tproxy
by Adi Nugroho 13 Mar '08

13 Mar '08

Dear all, I tried to instal openSUSE 10.3 + squid + tproxy, but don't know how to start. Is there a howto/tutorial how to set up squid in openSUSE 10.3 with tproxy? Or is there a precompiled kernel, iptables and squid with tproxy for opensuse 10.3? Thank you in advance. -- Salam, Adi Nugroho - http://adi.internux.co.id/ iNterNUX --- http://www.internux.net.id/ Jalan Dr. Sam Ratulangi No. 53J Makassar Tel. +62-411-834690 Fax. +62-411-834691 CDMA:+62-411-6109535 GSM:+62-816-27-9193

4 4

Help Tproxy
by Rosauro - RLINE 12 Mar '08

12 Mar '08

Hello, Need help to put the wheel with the TPROXY Squid 2.6, and that has repasse of ip's worth of customers to the Internet. I am using Kernel 2.6.22.1, installed the patch of TPROXY 4, which is composed of 13 patches. Recompiled the kernel, applied the patch in the iptables 1.3.8 and also applied the patch in Squid 2.6.18. The modules manually uploaded the way Modprobe ipt_TPROXY Modprobe iptable_tproxy My squid.conf set the http_port 3128 tproxy transparent But the rules of iptables, which comes with the README TPROXY, not work, the first rule seems to be wrong and the second not the mistake, but not working. The rules of the readme are these: Iptables-t nat-A PREROUTING-j DNAT - to-dest <localip> - to-port 3128 Iptables-t tproxy-A PREROUTING-j TPROXY - on-port 3128 Also tested with this: Iptables-t tproxy-A PREROUTING-p tcp - dport 80-j TPROXY - on-port 3128 In this case, the packages are accounted for in this rule, but not ai the traffic passing through proxy. Someone could give me a hint of where this the problem? Thanks Rosauro Baretta

1 0