- tproxy - lists.balabit.hu

Re: [tproxy] Fwd: Tproxy changes for performing dual NAT
by KOVACS Krisztian 20 Nov '07

20 Nov '07

Hi, On Mon, Oct 15, 2007 at 04:30:03PM +0530, Arun S wrote: > I am not aware of this. I have tried tproxy4.0.3 and > Squid-2.6-STABLE14. But real transparency was not happening. Does it > require support from the application too? Yes, and the modifications it requires are different compared to those of required by tproxy2. > Could you please throw some light on this? I don't have a patch for squid at the moment but creating one should be quite straigtforward. I'll try to come up with one once I find the time to do so. A very brief README: http://marc.info/?l=linux-netdev&m=119229721212273&w=2 As an example, here's the patch necessary to make netcat work: http://people.netfilter.org/hidden/tproxy/netcat-ip_transparent-support.pat… -- KOVACS Krisztian

8 35

tproxy on bridge interface
by Ondrej Kraus 14 Nov '07

14 Nov '07

Hello there, we have working machine with kernel 2.6.17.14, tproxy-4.0.1 and zorp 3.0.8. Network configuration of this router is: eth0: 192.168.0.1/24 eth1.10: 192.168.1.1/24 (eth1 vlan 10) eth1.11: 192.168.2.1/24 (eth1 vlan 11) dummy0: 192.168.3.1/32 Testing client is at 192.168.0.2 and testing http server at 192.168.2.2 (on vlan 11). When I load tproxy module with tproxy_any=1 and configure zorp for transparent proxying, everything works fine. But when I bind eth1.10 and eth1.11 to a bridge (br1): brctl addbr br1 brctl addif br1 eth1.10 brctl addif br1 eth1.11 ifconfig br1 192.168.1.1 netmask 255.255.255.0 ifconfig br1:0 192.168.2.1 netmask 255.255.255.0 then I can reach 192.168.2.2 from the route and from client, but zorp cannot. Communication flows from the client to the router, is redirected to zorp, zorp catches it, binds to clients ip address and sends SYN packet to the http server. But communication from the http server passes thru tproxy box without being catched by tproxy mechanisms. In the other words - client sees responses from zorp and responses from http server to zorp. Zorp never gets a packet from http server. I don't know what is wrong. Is it known issue? Is there any workaround for this problem? Thank you for any idea Ondrej Kraus

2 1

Redirect to proxy via TPROXY target didn't work.
by Mohamed Badri 09 Nov '07

09 Nov '07

Hi, I'm running Linux 2.6.22, Iptables 1.3.8, with Tproxy 4.0.3 patches I've added the following rules in iptables : iptables -t tproxy -A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j TPROXY --on-port 50080 iptables -t tproxy -A PREROUTING -i eth1 -p tcp -m tcp --dport 80 -j TPROXY --on-port 50080 but nothing happens, connexions to port 80 are not redirected to local port 50080. Can I use NETMAP target in nat table while using tproxy ? Did I miss something ? thank you.

2 2

Content rewrite.
by Mohamed Badri 07 Nov '07

07 Nov '07

HI, I'm currently installing tproxy on a server with iptables and squid patched. I'm going to use a redirector with squid to rewrite Urls requested by web clients, then I wanted to know if it's possible to parse the html responses from servers to modify urls in it transparently ? any patch to squid who can do that ? use apache ? thank's for any information. ----

1 0

Re: [tproxy] Fwd: Tproxy changes for performing dual NAT
by Siumafua Moala 05 Nov '07

05 Nov '07

Hello, How did you compile squid with linux 2.6.22. I tried but it complains about ip_tproxy.h, etc. I'm going back to earlier version until I saw your post that you are able to do this. Regards, S. Moala -----Original Message----- From: tproxy-bounces(a)lists.balabit.hu [mailto:tproxy-bounces@lists.balabit.hu] On Behalf Of Arun S Sent: Saturday, October 27, 2007 2:06 AM To: Tóth László Attila; KOVACS Krisztian Cc: tproxy(a)lists.balabit.hu Subject: Re: [tproxy] Fwd: Tproxy changes for performing dual NAT Hi Kovacs/Attila, I have successfully applied your patches tproxy4-2.6.22_20070622.tar.bz2 on linux-2.6.22 and got all the modules compiled. Also iptables-1.4.0rc1 is applied with the patch iptables-tproxy-200710091749.diff. But I get error while adding the following rule: [root@Arun-FC6-SQUID linux-tproxy4-RnD]# iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --tproxy-mark iptables v1.4.0rc1: Unknown arg `--tproxy-mark' Try `iptables -h' or 'iptables --help' for more information. [root@Arun-FC6-SQUID linux-tproxy4-RnD]# iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 3128 iptables: Invalid argument Am I missing anything? TIA. Regards, Arun S. On 23/10/2007, Arun S <hi2arun(a)gmail.com> wrote: > Hi, > > Thank you. I will get this downloaded and try to tweak Squid to work > for the latest tproxy4 changes. > > Will let you know the changes in Squid once I manage to get Squid > compiled for tproxy4. > > > > On 22/10/2007, Tóth László Attila <panther(a)elte.hu> wrote: > > Hello, > > > > On 2007.10.22., at 18:51, Arun S wrote: > > > > > Hi Attila / Krisztian, > > > > > > Could you please tell me which version of linux kernel shall I use to > > > try the latest tproxy4 changes and from where shall I get the latest > > > tproxy4 patches? > > > > > > > 2.6.23 should be ok with both version: at www.balabit.com and at > > http://people.netfilter.org/hidden/tproxy/ > > The first one is tested for 2.6.22 only. > > > > How can it enabled in squid: I don't know the source code but it > > requires no secial code with TProxy4 except set the IP_TRANSPARENT > > socket option for lisening socket. It is a new option: > > #define IP_TRANSPARENT 19 > > > > HTH, > > Attila > > > > > > > > > > > -- > Regards, > Arun S. > -- Regards, Arun S. _______________________________________________ tproxy mailing list tproxy(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/tproxy

2 1

Tproxy ip=xxx.xxx.xxx.xxx, 0x100007f,port=0 ERROR ASSIGN
by Rodrigo Ferreira Santos 26 Oct '07

26 Oct '07

Friends, I thank everyone for their help and I am grateful for everything that I am almost done, and iptables cttproxy worked with the kernel modules also but now he is not going ip valid customers and appearing so this error: 2007/10/25 15:27:23| tproxy ip=127.0.0.1,0x100007f,port=0 ERROR ASSIGN 2007/10/25 15:27:23| tproxy ip=127.0.0.1,0x100007f,port=0 ERROR ASSIGN My squid conf this way: http_port 3128 transparent tproxy cache_mem 256 MB cache_swap_low 90 cache_swap_high 95 maximum_object_size 400096 KB cache_replacement_policy lru memory_replacement_policy lru cache_dir ufs /var/spool/squid/squid 30000 16 256 cache_dir ufs /var/spool/squid/squid1 30000 16 256 cache_dir ufs /var/spool/squid/squid2 30000 16 256 access_log /var/log/squid/access.log squid cache_log /var/log/squid/cache.log cache_store_log /var/log/squid/store.log pid_filename /var/run/squid.pid client_netmask 255.255.255.255 request_header_max_size 20 KB acl all src 0.0.0.0/0.0.0.0 dns_nameservers 127.0.0.1 201.30.200.3 acl manager proto cache_object acl minha_rede src 201.30.200.0/25 189.3.1.0/24 189.3.0.0/25 acl localhost src 127.0.0.1/255.255.255.255 acl to_localhost dst 127.0.0.0/8 acl purge method PURGE http_access allow minha_rede http_access allow manager localhost http_access deny manager http_access allow purge localhost http_access deny purge http_access allow localhost http_access deny all http_reply_access allow all icp_access allow all cache_mgr rodrigofsantos(a)gmail.com cache_effective_user proxy cache_effective_group proxy logfile_rotate 0 forwarded_for on error_directory /usr/share/squid/errors/Portuguese tcp_outgoing_address 0 always_direct allow all wccp_router 201.30.200.1 wccp_version 42 coredump_dir /var/spool/squid -- ---------------------------------------------------- (o_ Rodrigo Ferreira Santos //\ Gerente de TI V_/_ ICQ - 15372370 aMSN - rodrigofsantos(a)gmail.com Linux user number 372852 ----------------------------------------------------

2 1

Tproxy error loading rule of iptables
by Rodrigo Ferreira Santos 24 Oct '07

24 Oct '07

I need help with problems already done all this work and the squid and the kernel already have the modules but the iptables not look so raises the error message: cache:~# iptables -t tproxy -A PREROUTING -i eth1 -p tcp --dport 80 -j TPROXY --on-port 3128 iptables v1.3.6: Unknown arg `--on-port' Try `iptables -h' or 'iptables --help' for more information. cache:~# lsmod | grep tproxy ipt_tproxy 1792 0 iptable_tproxy 16632 0 iptable_nat 7332 1 iptable_tproxy ip_nat 22220 2 iptable_tproxy,iptable_nat ip_conntrack 50400 3 iptable_tproxy,iptable_nat,ip_nat ip_tables 12964 4 iptable_mangle,iptable_filter,iptable_tproxy,iptable_nat x_tables 13316 3 ipt_tproxy,iptable_nat,ip_tables Need urgent help if possible............. -- ---------------------------------------------------- (o_ Rodrigo Ferreira Santos //\ Gerente de TI V_/_ ICQ - 15372370 aMSN - rodrigofsantos(a)gmail.com Linux user number 372852 ----------------------------------------------------

3 2

Re: [tproxy] Tproxy error loading rule of iptables
by Laszlo Attila Toth 24 Oct '07

24 Oct '07

And what is the output of extensions/.tproxy-test? Is these lines? TPROXY tproxy I see that the tproxy match is loaded, but the TPROXY target is not: ipt_TPROXY is missing from the module list. Did you enable the TPROXY target? In .config: CONFIG_IP_NF_TARGET_TPROXY=m Rodrigo Ferreira Santos írta: > Yes Laszlo applied the patch this: > | > cd /usr/src/iptables-1.3.6.0debian1 > cat <pathtocttproxy>/iptables/iptables-1.3-cttproxy.diff | patch -p1 > chmod +x extensions/.tproxy-test > make KERNELDIR=/usr/src/linux| > > Once installed this: > > |cd /usr/src/iptables-1.3.6.0debian1 > dpkg-buildpackage -b -rfakeroot > cd /usr/src/ > dpkg -i iptables_1.3.6.0debian1-5_i386.deb > > | > Have the following modules loaded > > > ipt_tproxy 1792 0 > iptable_tproxy 16632 0 > iptable_nat 7332 1 iptable_tproxy > ip_nat 22220 2 iptable_tproxy,iptable_nat > ip_conntrack 50400 3 iptable_tproxy,iptable_nat,ip_nat > ip_tables 12964 4 > iptable_mangle,iptable_filter,iptable_tproxy,iptable_nat > x_tables 13316 3 ipt_tproxy,iptable_nat,ip_tables > > Thank you for your attention .. > > > > > > > 2007/10/24, Laszlo Attila Toth < panther(a)balabit.hu > <mailto:panther@balabit.hu>>: > > Rodrigo Ferreira Santos írta: > > I need help with problems already done all this work and the > squid and > > the kernel already have the modules but the iptables not look so > raises > > the error message: > > > > cache:~# iptables -t tproxy -A PREROUTING -i eth1 -p tcp --dport > 80 -j > > TPROXY --on-port 3128 > > iptables v1.3.6: Unknown arg `--on-port' > > Try `iptables -h' or 'iptables --help' for more information. > > > > Did you applied the iptables patch? I got this message when I tried to > use iptables without TPROXY target. > > -- > Panther > -- Panther

1 0

Tproxy error in the installation! ! !
by Rodrigo Ferreira Santos 23 Oct '07

23 Oct '07

Staff did everything Sibneft and I am not able to work need help even looks so: The patch applied in the kernel: cache:/usr/src/linux# cat /usr/src/tproxy/patches/tproxy.diff | patch -p1 patching file include/linux/netfilter/xt_TPROXY.h patching file include/linux/netfilter_ipv4.h patching file include/linux/skbuff.h patching file include/net/dst.h patching file include/net/inet_sock.h patching file include/net/ip.h patching file include/net/route.h patching file include/net/tcp.h patching file include/net/udp.h patching file net/ipv4/inet_connection_sock.c patching file net/ipv4/netfilter/Kconfig patching file net/ipv4/netfilter/Makefile patching file net/ipv4/netfilter/iptable_tproxy.c patching file net/ipv4/route.c patching file net/ipv4/tcp_ipv4.c patching file net/ipv4/tcp_output.c patching file net/ipv4/udp.c patching file net/netfilter/Kconfig patching file net/netfilter/Makefile patching file net/netfilter/xt_TPROXY.c patching file net/netfilter/xt_tproxy.c The patch applied in iptables: cache:/usr/src/iptables# cat /usr/src/tproxy/patches/iptables-1.3.8.diff | patch -p1 patching file extensions/libip6t_tproxy.man patching file extensions/libipt_tproxy.c patching file extensions/libipt_TPROXY.c patching file extensions/libipt_tproxy.man patching file extensions/libipt_TPROXY.man patching file extensions/.tproxy-test After compiling the kernel noticed the modules and have compiled: cache:~# modprobe --list | grep tproxy /lib/modules/2.6.22.10rod1/kernel/net/ipv4/netfilter/iptable_tproxy.ko /lib/modules/2.6.22.10rod1/kernel/net/netfilter/xt_tproxy.ko But when I compile the squid with -- enable - linux-tproxy appears the following error: ./configure --prefix=/usr --sysconfdir=/etc/squid --libexecdir=/usr/libexec/squid --datadir=/usr/share/squid --enable-dlmalloc --enable-wccp --with-maxfd=8192 --enable-gnuregex --enable-carp --enable-storeio=diskd,ufs --enable-head-replacement --enable-removal-polices=heap,lru --enable-icmp --enable-epoll --enable-useragent-log --enable-referer-log --enable-arp-acl --enable-htcp --enable-cache-digests --enable-err-laguage=Portuguese --enable-ident-lookup --enable-truncate --enable-underscore --enable-linux-netfilter --enable-snmp --enable-ipf-transparent --enable-pf-transparent --enable-linux-netfilter --enable-large-cache-files --enable-linux-tproxy --enable-leakfinder checking if IP-Filter header files are installed... no WARNING: Cannot find necessary IP-Filter header files Transparent Proxy support WILL NOT be enabled checking if PF header file is installed... no WARNING: Cannot find necessary PF header file Transparent Proxy support WILL NOT be enabled checking if Linux 2.4 or newer kernel header files are installed... yes checking if TPROXY header files are installed... no WARNING: Cannot find TPROXY headers, you need to install the tproxy package from: - lynx http://www.balabit.com/downloads/tproxy/ What I do, need help finish this server if you have any suggestion someone please can even exchange version of the kernel or distro but must resolve, a friend of the forum here I spoke of cttproxy but not thought to download, something debian have a package called transproxy which is the tproxy that runs directly, I can also use it? ? ? -- ---------------------------------------------------- (o_ Rodrigo Ferreira Santos //\ Gerente de TI V_/_ ICQ - 15372370 aMSN - rodrigofsantos(a)gmail.com Linux user number 372852 ----------------------------------------------------

2 1

Squid does not recognize tproxy iptables also not! ! !
by Rodrigo Ferreira Santos 22 Oct '07

22 Oct '07

Following is a personal pleasure to be part of this list I already installing the tproxy here at my company but so far is not working, compiled the kernel pressed the module, and compiled the iptables my server this way: cache:/# uname -a Linux cache 2.6.22.10-tproxy #1 SMP Thu Oct 18 22:30:57 AMT 2007 i686 GNU/Linux cache:/# lsmod xt_tproxy 1984 0 ip_gre 12608 0 ipt_addrtype 1952 0 ip_queue 10480 0 ipt_REJECT 4608 0 arptable_filter 2272 0 arp_tables 11204 1 arptable_filter ipt_ULOG 8036 0 iptable_mangle 2912 0 ipt_tos 1760 0 ipt_TOS 2336 0 ipt_LOG 6208 0 ipt_ECN 3008 0 ipt_ttl 1984 0 ipt_ah 2016 0 ipt_TTL 2432 0 ipt_recent 9048 0 ipt_iprange 1888 0 iptable_raw 2496 0 ipt_ecn 2304 0 arpt_mangle 2560 0 ipt_owner 2080 0 iptable_filter 3104 1 iptable_tproxy 6468 0 ip_tables 12420 4 iptable_mangle,iptable_raw,iptable_filter,iptable_tproxy x_tables 14564 18 xt_tproxy,ipt_addrtype,ipt_REJECT,arp_tables,ipt_ULOG,ipt_tos,ipt_TOS,ipt_LOG,ipt_ECN,ipt_ttl,ipt_ah,ipt_TTL,ipt_recent,ipt_iprange,ipt_ecn,arpt_mangle,ipt_owner,ip_tables button 8080 0 ipv6 237412 18 i2c_viapro 8340 0 8139cp 22080 0 3c59x 41256 0 8139too 25472 0 My squid this configured this way: This compiled with the settings: cache:/# squid -v Squid Cache: Version 2.6.STABLE16-20071017 configure options: '--prefix=/usr' '--sysconfdir=/etc/squid' '--libexecdir=/usr/libexec/squid' '--datadir=/usr/share/squid' '--enable-dlmalloc' '--enable-wccp' '--with-maxfd=8192' '--enable-gnuregex' '--enable-carp' '--enable-storeio=diskd,ufs' '--enable-head-replacement' '--enable-removal-polices=heap,lru' '--enable-icmp' '--enable-epoll' '--enable-useragent-log' '--enable-referer-log' '--enable-arp-acl' '--enable-htcp' '--enable-cache-digests' '--enable-err-laguage=Portuguese' '--enable-ident-lookup' '--enable-truncate' '--enable-underscore' '--enable-linux-netfilter' '--enable-snmp' cache:/# squid -d 3 -F -N -X 2007/10/20 10:30:19| Processing: 'icp_access allow all' 2007/10/20 10:30:19| parse_line: icp_access allow all 2007/10/20 10:30:19| aclParseAccessLine: looking for ACL name 'all' 2007/10/20 10:30:19| Processing: 'http_port 8080 transparent tproxy' 2007/10/20 10:30:19| parse_line: http_port 8080 transparent tproxy FATAL: Bungled squid.conf line 925: http_port 8080 transparent tproxy Squid Cache (Version 2.6.STABLE16-20071017): Terminated abnormally. This configured so my squid: cache:/# cat /etc/squid/squid.conf httpd_accel_host virtual httpd_accel_port 80 httpd_accel_with_proxy on httpd_accel_uses_host_header on acl all src 0.0.0.0/0.0.0.0 acl minha_rede src 201.30.200.0/255.255.255.128 acl manager proto cache_object acl localhost src 127.0.0.1/255.255.255.255 acl to_localhost dst 127.0.0.0/8 acl SSL_ports port 443 acl Safe_ports port 80 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 # https acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl CONNECT method CONNECT http_access allow minha_rede http_access allow manager localhost http_access deny manager http_access deny !Safe_ports http_access deny CONNECT !SSL_ports http_access deny all icp_access allow all http_port 8080 transparent tproxy hierarchy_stoplist cgi-bin ? cache_mem 256 MB maximum_object_size_in_memory 512 KB memory_replacement_policy lru cache_replacement_policy lru cache_dir ufs /var/cache/squid/squid1 10000 16 256 cache_dir ufs /var/cache/squid/squid2 10000 16 256 cache_dir ufs /var/cache/squid/squid3 10000 16 256 cache_swap_low 90 cache_swap_high 95 access_log /var/log/squid/access.log cache_log /var/log/squid/cache.log cache_store_log /var/log/squid/store.log logfile_rotate 10 mime_table /etc/squid/mime.conf pid_filename /var/logs/squid.pid client_netmask 255.255.255.255 acl QUERY urlpath_regex cgi-bin \? cache deny QUERY refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern . 0 20% 4320 request_header_max_size 20 KB reply_header_max_size 20 KB acl apache rep_header Server ^Apache broken_vary_encoding allow apache cache_mgr rodrigofsantos(a)gmail.com cache_effective_user proxy snmp_port 3401 snmp_access deny all error_directory /var/cache/squid/errors/Portuguese hosts_file /etc/hosts forwarded_for on coredump_dir /usr/local/squid//var/cache Please need much help from staff of you .. May God bless you all. -- ---------------------------------------------------- (o_ Rodrigo Ferreira Santos //\ Gerente de TI V_/_ ICQ - 15372370 aMSN - rodrigofsantos(a)gmail.com Linux user number 372852 ----------------------------------------------------

2 1