- tproxy - lists.balabit.hu

Squid with TProxy Support
by Firas Rasmy 05 Jul '13

05 Jul '13

Hello there! I'm trying to install squid with TPROXY support. I'm using a Centos 6.4 (64-bit) with kernel version 2.6.32-358.el6.x86_64 and iptables version 4.1.7 I've followed the instructions in http://wiki.squid-cache.org/Features/Tproxy4 but unfortunately connecting to any website from a client with Chrome browser fails with this error: Error 324 (net::ERR_EMPTY_RESPONSE): The server closed the connection without sending any data. When trying to telnet squid on port 80, I get a connection but the connection is closed once I hit any key! I think packets are being redirected to squid successfully because if I stop squid, there would be no connections at all. Do you have any idea of what might be the reason? Another question, I have checked that my current kernel was already built with those options: NF_CONNTRACK=m NETFILTER_TPROXY=m NETFILTER_XT_MATCH_SOCKET=m NETFILTER_XT_TARGET_TPROXY=m Do I still have to recompile it with patches from http://www.balabit.com/downloads/files/tproxy/? There are no patches available for this current version. What about iptables? Do I need to patch it? My last question is: TPROXY target in the mangle table is not supposed to change anything in the packet header, how the packets with TPROXY target would be redirected to --on-port if the IP header is untouched?! Thanks a lot for your help! Best regards, Firas

2 3

Re: [tproxy] Squid with TProxy Support
by Chinmay Mahata 05 Jul '13

05 Jul '13

Hi Firas,     Your understanding is absolutely correct. Regards, --Chinmay  From: Firas Rasmy <firasrasmy(a)yahoo.com> Sent: Wed, 03 Jul 2013 04:34:02 To: "tproxy(a)lists.balabit.hu" <tproxy(a)lists.balabit.hu> Subject: Re: [tproxy] Squid with TProxy Support Thanks a lot for your reply Eliezer! I have another question here regarding the following iptables rules, which are needed to get TPROXY to work: iptables -t mangle -N DIVERTiptables -t mangle -A DIVERT -j MARK --set-mark 1iptables -t mangle -A DIVERT -j ACCEPTiptables  -t mangle -A PREROUTING -p tcp -m socket -j DIVERT iptables  -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 3129  What is "-m socket" used for? Man page of iptables says that "-m socket" matches if an open socket can be found by doing a socket lookup on the packet. I think the following rule is intended for reply packets coming from web servers to squid (with the spoofed IP address), am I right? If not, please correct me:iptables  -t mangle -A PREROUTING -p tcp -m socket -j DIVERT Best regards,Firas From: Eliezer Croitoru <eliezer(a)ngtech.co.il> To: tproxy(a)lists.balabit.hu Sent: Monday, July 1, 2013 11:00 PM Subject: Re: [tproxy] Squid with TProxy Support Centos comes with TPROXY so you don't need to recompile or do anything more then to bundled kernel from CentOS. Take a small peek at this tutorial: http://wiki.squid-cache.org/ConfigExamples/UbuntuTproxy4Wccp2 The tutorial have all the working examples that are needed for tproxy with squid. If you will need more help you can try squid-users. Eliezer On 07/01/2013 09:37 PM, Firas Rasmy wrote: > Hello there! > > I'm trying to install squid with TPROXY support. I'm using a Centos 6.4 > (64-bit) with kernel version 2.6.32-358.el6.x86_64 and iptables version > 4.1.7 > > I've followed the instructions in > http://wiki.squid-cache.org/Features/Tproxy4 but unfortunately > connecting to any website from a client with Chrome browser fails with > this error: > Error 324 (net::ERR_EMPTY_RESPONSE): The server closed the connection > without sending any data. > > When trying to telnet squid on port 80, I get a connection but the > connection is closed once I hit any key! I think packets are being > redirected to squid successfully because if I stop squid, there would be > no connections at all. Do you have any idea of what might be the reason? > > Another question, I have checked that my current kernel was already > built with those options: > NF_CONNTRACK=m > NETFILTER_TPROXY=m > NETFILTER_XT_MATCH_SOCKET=m > NETFILTER_XT_TARGET_TPROXY=m > > Do I still have to recompile it with patches from > http://www.balabit.com/downloads/files/tproxy/? > There are no patches available for this current version. What about > iptables? Do I need to patch it? > > My last question is: TPROXY target in the mangle table is not supposed > to change anything in the packet header, how the packets with TPROXY > target would be redirected to --on-port if the IP header is untouched?! > > Thanks a lot for your help! > > Best regards, > Firas > > > _______________________________________________ > tproxy mailing list > tproxy(a)lists.balabit.hu');" >tproxy(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/tproxy > _______________________________________________ tproxy mailing list tproxy(a)lists.balabit.hu');" >tproxy(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/tproxy _______________________________________________ tproxy mailing list tproxy(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/tproxy

1 0

TPROXY with UDP on random ports
by Thomas Penteker 26 Jun '13

26 Jun '13

Hello, After consulting various resources wihtout success I hope to find help on this mailing-list. I want to intercept all UDP traffic leaving tap1. And possibly reply to e.g. DNS-requests. To accomplish this I wrote some python code listening to localhost and use iptables with a rule-set like this: Chain PREROUTING (policy ACCEPT 2 packets, 333 bytes) pkts bytes target prot opt in out source destination 0 0 DIVERT udp -- tap1 any anywhere anywhere socket 0 0 TPROXY udp -- tap1 any anywhere anywhere TPROXY redirect 127.0.0.1:5001 mark 0x1/0x1 Chain DIVERT (1 references) pkts bytes target prot opt in out source destination 0 0 MARK udp -- any any anywhere anywhere MARK set 0x1 0 0 ACCEPT udp -- any any anywhere anywhere Policy routing is done with: ip rule add fwmark 1 lookup 100 ip route add local 0.0.0.0/0 dev lo table 100 This setup was adapted from the kernel's Documentation/networking/tproxy.txt. This works flawlessly for a TCP socket opened with the IP_TRANSPARENT option. Unfortunately UDP sockets don't seem to be able to handle connections. For example if I do a ncat -u localhost 1234 the socket will receive data but cannot send anything back. Wireshark will show exactly three packets for: the incoming ncat packet (to localhost:1234) the outgoing packet of my software (to :5001) an ICMP Port unreachable (of course) For arbitrary ports to work I guess it's not feasable to set up proper (S)NATting rules. So, what's the necessary setup to make this work for arbitrary incoming ports? Thanks for your help with kind regards, Thomas Penteker

2 1

Fwd: tproxy on fedora core 4
by ma~sha 06 Jun '13

06 Jun '13

I have installed squid server 2.6.18 in transparent mode on fedora core 4 before but now I want to install tproxy mode and test it's capabilities for using later. Is installation similar to transparent installation? If no can any one explain that briefly? On Tue, Jun 4, 2013 at 4:59 PM, senthil kumar <senthilkumaar2021(a)gmail.com>wrote: > I can help you in installing tproxy . > > May i know your requirement? Are you an ISP? > > > On Mon, Jun 3, 2013 at 4:17 PM, ma~sha <sspardis2(a)gmail.com> wrote: > >> I want to install squid server. >> how should I do it? is it possible to give me a guideline please? >> >> thanks >> >> >> On Mon, Jun 3, 2013 at 2:22 PM, Chinmay Mahata < >> chinmay_mahata(a)rediffmail.com> wrote: >> >>> Hello, >>> Which proxy server you are trying to install? >>> >>> If you could not find any package, build it from source code. >>> >>> Regards, >>> --Chinmay >>> >>> >>> From: "ma~sha" <sspardis2(a)gmail.com> >>> Sent: Mon, 03 Jun 2013 14:47:43 >>> To: tproxy(a)lists.balabit.hu >>> Subject: [tproxy] tproxy on fedora core 4 >>> >>> Hi all, >>> I want to install proxy server in tproxy mode on fedora core 4 based on >>> kernel 2.6.11. I could not find any 2.6.11 related package on balabit. >>> should I upgrade kernel to newer version? I tried to upgrade and compile >>> kernel to 2.6.25 version but it failed in any way. can any one help me? >>> >>> thanks >>> _______________________________________________ >>> tproxy mailing list >>> tproxy(a)lists.balabit.hu >>> https://lists.balabit.hu/mailman/listinfo/tproxy >>> >>> >>> <http://sigads.rediff.com/RealMedia/ads/click_nx.ads/www.rediffmail.com/sign…> >>> Get your own *FREE* website and domain with business email solutions, click >>> here<http://track.rediff.com/click?url=___http://hosting.rediff.com/rediffmailpr…> >>> >> >> >> _______________________________________________ >> tproxy mailing list >> tproxy(a)lists.balabit.hu >> https://lists.balabit.hu/mailman/listinfo/tproxy >> >> >

2 1

Re: [tproxy] Tproxy
by Chinmay Mahata 06 Jun '13

06 Jun '13

Hi Alvaro,    At the first place your query is not clear. What you have seen, that's exactly the nature of Tproxy server. For this purpose only Tproxy has been developed. BTW, which server are you using with Tproxy? Regards, --Chinmay From: Alvaro Gonz lez Polo <alvarix.gp(a)gmail.com> Sent: Thu, 06 Jun 2013 00:13:12 To: tproxy(a)lists.balabit.hu Subject: [tproxy] Tproxy Good morning, Actually I am trying to understand the modifications that Tproxy does in the processed packets sent by a proxy with two interfaces. This proxy redirect the traffic from a local LAN to Internet. When I analyze the outgoing packets with Wireshark, I can see that the proxy has added the source's IP (client). I think that I should not see it. Where can I find some information about these modifications? I have been looking on Google for days but I didn't find anything. Thank you in advance. Regards, Alvaro _______________________________________________ tproxy mailing list tproxy(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/tproxy

1 0

Tproxy
by Alvaro González Polo 05 Jun '13

05 Jun '13

Good morning, Actually I am trying to understand the modifications that Tproxy does in the processed packets sent by a proxy with two interfaces. This proxy redirect the traffic from a local LAN to Internet. When I analyze the outgoing packets with Wireshark, I can see that the proxy has added the source's IP (client). I think that I should not see it. Where can I find some information about these modifications? I have been looking on Google for days but I didn't find anything. Thank you in advance. Regards, Alvaro

1 0

Re: [tproxy] tproxy on fedora core 4
by ma~sha 03 Jun '13

03 Jun '13

I want to install squid server. how should I do it? is it possible to give me a guideline please? thanks On Mon, Jun 3, 2013 at 2:22 PM, Chinmay Mahata < chinmay_mahata(a)rediffmail.com> wrote: > Hello, > Which proxy server you are trying to install? > > If you could not find any package, build it from source code. > > Regards, > --Chinmay > > > From: "ma~sha" <sspardis2(a)gmail.com> > Sent: Mon, 03 Jun 2013 14:47:43 > To: tproxy(a)lists.balabit.hu > Subject: [tproxy] tproxy on fedora core 4 > > Hi all, > I want to install proxy server in tproxy mode on fedora core 4 based on > kernel 2.6.11. I could not find any 2.6.11 related package on balabit. > should I upgrade kernel to newer version? I tried to upgrade and compile > kernel to 2.6.25 version but it failed in any way. can any one help me? > > thanks > _______________________________________________ > tproxy mailing list > tproxy(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/tproxy > > > <http://sigads.rediff.com/RealMedia/ads/click_nx.ads/www.rediffmail.com/sign…> > Get your own *FREE* website and domain with business email solutions, click > here<http://track.rediff.com/click?url=___http://hosting.rediff.com/rediffmailpr…> >

1 0

tproxy on fedora core 4
by ma~sha 03 Jun '13

03 Jun '13

Hi all, I want to install proxy server in tproxy mode on fedora core 4 based on kernel 2.6.11. I could not find any 2.6.11 related package on balabit. should I upgrade kernel to newer version? I tried to upgrade and compile kernel to 2.6.25 version but it failed in any way. can any one help me? thanks

2 1

Re: [tproxy] tproxy on fedora core 4
by Chinmay Mahata 03 Jun '13

03 Jun '13

Hello,    Which proxy server you are trying to install? If you could not find any package, build it from source code.  Regards, --Chinmay From: "ma~sha" <sspardis2(a)gmail.com> Sent: Mon, 03 Jun 2013 14:47:43 To: tproxy(a)lists.balabit.hu Subject: [tproxy] tproxy on fedora core 4 Hi all,I want to install proxy server in tproxy mode on fedora core 4 based on kernel 2.6.11. I could not find any 2.6.11 related package on balabit. should I upgrade kernel to newer version? I tried to upgrade and compile kernel to 2.6.25 version but it failed in any way. can any one help me? thanks _______________________________________________ tproxy mailing list tproxy(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/tproxy

1 0

Tproxy Issue :: For React Message
by Chinmay Mahata 03 Apr '13

03 Apr '13

Hi All,     I am new to this group and hope I have posted my (big)problem in the right place.     I am doing some test in my network using tproxy and a scanner process in a server (bridged/inline) machine. The packet like http requests from my LAN side, goes to tproxy process and then pass through a scanner process and finally send out to the internet. Topology: LAN (192.168.11.0/24) <-----> Tprox-Server (bridge - 192.168.11.231) <-----> (192.168.11.1)router <------> Internet                 +-------------------------------------+                 |  +--------+        +-----------+  |  LAN -------+  |tproxy|<------>|scanner|  +------ WAN           eth0|  +--------+        +----------+   |eth1                 +-------------------------------------+                          Tprox-sever     iface ETH1 with no ip configured (connected in a gw ip 192.168.11.1)     iface ETH0 with no ip configured(all the clients behind this interface 192.168.11.0/24)     br0 with ip adress 192.168.11.231 with ports ETH0(lan) and ETH1(wan). I have this test platform:     Fedora 13 (Linux)     kernel 2.6.34.9     iptables 1.4.7     tproxy process running on port 8080 Used proc interface for setting following:     echo 0 > /proc/sys/net/ipv4/conf/lo/rp_filter     echo 1 > /proc/sys/net/ipv4/ip_forward     echo 0 > /proc/sys/net/ipv4/conf/eth1/rp_filter     echo 0 > /proc/sys/net/ipv4/conf/eth0/rp_filter     echo 0 > /proc/sys/net/ipv4/conf/br0/rp_filter iptables/ebtables rules:     iptables -t mangle -N DIVERT     iptables -t mangle -A DIVERT -j MARK --set-mark 0x01/0x01     iptables -t mangle -A DIVERT -j ACCEPT     iptables -t mangle -A PREROUTING -p tcp -m tcp --sport 80 --m socket -j DIVERT     iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 8080 --on-ip 0.0.0.0     ebtables -t broute -A BROUTING -i eth0 -p ipv4 --ip-proto tcp --ip-dport 80 -j redirect --redirect-target DROP     ebtables -t broute -A BROUTING -i ! eth0 -p ipv4 --ip-proto tcp --ip-sport 80 -j redirect --redirect-target DROP Policy routing:     ip rule add fwmark 1 lookup 1     ip route add local 0.0.0.0/0 dev lo table 1 Till here everything is working fine. I can access the Internet trough the tproxy and scanner process. BUT -- In the scanner process I have reaction mechanism, if the scanner finds something bad in the packet it sends back a customized response/reaction to the client/browser and drop the packet (by hijacking the session). This scanner snips the packets in the OUTPUT chain of filter table.     With this tproxy configuration/setting, it seems the reacting method is not working. The client bowser keeps on waiting for the response without success, and finally gives server down kind of message in the browser window.     Using iptables trace, it seems that the scanner directly sends the react message to the client browser (the message is seen in OUTPUT and POSTROUTING chain), but since the sequence and acknowledge numbers do match the browser drops the react message. (The react message should go to tproxy from the scanner, then from tproxy to the client browser). Then I used follwoing iptables rules so that the react packet is send back to the tproxy from OUTPUT chain.     iptables -t mangle -A OUTPUT -d 192.168.11.0/24 -p tcp -m tcp --sport 80 --m owner --uid-owner scan -j DIVERT     (where the scannner module is running under user scan) But now it seems that the packet is getting dropped after OUTPUT chain, I can not trace the packet in INPUT chain, not even in POSTROUTING chain. I think the packet is getting dropped somewhere in the routing subsystem (policy routing). Please help me how to overcome the problem. Also please let me know if you need any more information. Best regards, --Chinmay

1 0