- tproxy - lists.balabit.hu

Re: [tproxy] TPROXY + Cisco Firewall
by Jojy Varghese 16 Aug '07

16 Aug '07

Hi I thought some more info might be helpful for someone following this thread. In my code, when I call "setsockopt" to set the TPROXY_ASSIGN and TPROXY_FLAGS options, I get an error. Please see the code below. Any ideas why this might be? Also, if I set the local address port to 0 or the foreign address port to 0, how does that matter? IN other words, how important is the port assignment? thanks in advance Jojy ##### Code Begins ######################### struct in_tproxy itp; struct sockaddr_in sin; itp.op = TPROXY_VERSION; itp.v.version = 0x02000000; if(setsockopt(handle,SOL_IP,IP_TPROXY,&itp,sizeof(itp)) == -1 ) { __log(LOG_ERROR, L"Error Setting version"); } sin.sin_family=AF_INET; inet_aton("192.168.1.74", &sin.sin_addr); sin.sin_port=htons(9999); if(bind(handle, (struct sockaddr*)&sin, sizeof(sin)) == -1) { __log(LOG_ERROR, L"Error Binding"); } itp.op = TPROXY_ASSIGN; inet_aton("192.168.1.75", (struct in_addr *)&itp.v.addr.faddr); itp.v.addr.fport=htons(2000); if(setsockopt(handle,SOL_IP,IP_TPROXY,&itp,sizeof(itp)) == -1 ) { __log(LOG_ERROR, L"Error Setting Assign Option "); } itp.op = TPROXY_FLAGS; itp.v.flags = ITP_CONNECT; if(setsockopt(handle,SOL_IP,IP_TPROXY,&itp,sizeof(itp)) == -1 ) { __log(LOG_ERROR, L"Error Setting Flags Option "); } // Code to connect follows ### Code ends #### #### Message: 1 Date: Mon, 13 Aug 2007 10:13:15 +0200 From: Laszlo Attila Toth <panther(a)balabit.hu> Subject: Re: [tproxy] TPROXY + Cisco Firewall To: tproxy(a)lists.balabit.hu Message-ID: <200708131013.16001.panther(a)balabit.hu> Content-Type: text/plain; charset="utf-8" On Sunday 12 August 2007 00.28.07 Jojy Varghese wrote: > Hi all > 3. > I have verified my changes by creating a REDIRECTION rule in the tproxy > chain (can list my iptable changes by doing "iptables -t tproxy -L") Hello, For instance a client try to connect to a webserver somewhere on the Internet listening on port 80, and your proxy is listening on port 50080. The iptables rule that redirects packets to that port is the following: iptables -t tproxy -p tcp --dport 80 -j TPROXY --on-port 50080 The next one is to allow incomming traffic on that port. Because the TPROXY target marks the packet, the following rule accepts these packets: iptables -t filter -A INPUT -m tproxy -j ACCEPT A tutorial is available here: http://www.balabit.hu/network-security/zorp-gateway/gpl/tutorial/ -- Regards, Laszlo Attila Toth ------------------------------ _______________________________________________ tproxy mailing list tproxy(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/tproxy End of tproxy Digest, Vol 26, Issue 11 ************************************** Shape Yahoo! in your own image. Join our Network Research Panel today! ____________________________________________________________________________________ Shape Yahoo! in your own image. Join our Network Research Panel today! http://surveylink.yahoo.com/gmrs/yahoo_panel_invite.asp?a=7

3 4

TPROXY + Arp Table
by Jojy Varghese 16 Aug '07

16 Aug '07

Hi I was trying the example code given with the patch and couldnt get it to work. Upon tcpdump'ing the packets, I found out that my firewall(Cisco) sends out a ARP request for the FOREIGN IP address i am masquerading the request as and after that the packet is dropped. How do I get around this problem? I am sure this is nothing unusual setting and I might be missing something fundamental here. Any help is much appreciated. thanks, Jojy ____________________________________________________________________________________Ready for the edge of your seat? Check out tonight's top picks on Yahoo! TV. http://tv.yahoo.com/

2 1

TProxy version 4.0.0 released
by Laszlo Attila Toth 15 Aug '07

15 Aug '07

Hi, TProxy version 4.0.0 has been released for Linux 2.6.17 (Ubuntu 2.6.17.1-12.39) and 2.6.23-rc1 This is a completely rewritten version which no longer uses NAT. The release tarballs are available here: http://www.balabit.com/downloads/files/tproxy/ MD5 checksums of the tarballs: a655fd090c06827bd6927f2b894ee178 tproxy-4.0.0-2.6.23-rc1.tgz d7175531d67beaab48293cd86cac5d21 tproxy-4.0.0-ubuntu-2.6.17-12.39.tgz -- Regards, Laszlo Attila Toth

7 28

Re: [tproxy] TPROXY + Cisco Firewall
by Jojy Varghese 13 Aug '07

13 Aug '07

Hi Thanks for your response. I am able to get the traffic redirected to my proxy server port. But the whole behavior is as if the tproxy kernel patch is not applied. In other words, on the web server I see that the request is coming from my proxy server and not from the client. The client IP is not getting rewritten after the socket options are applied. Also, I am observing that if I set the "itp.v.addr.fport" to 0, the proxy server doesnt even get the request from the client.(Here itp is a variable of type struct in_tproxy). So I had to assign the fport to a valid non-zero number. Any help is much appreciated. thanks again, Jojy #### Message: 1 Date: Mon, 13 Aug 2007 10:13:15 +0200 From: Laszlo Attila Toth <panther(a)balabit.hu> Subject: Re: [tproxy] TPROXY + Cisco Firewall To: tproxy(a)lists.balabit.hu Message-ID: <200708131013.16001.panther(a)balabit.hu> Content-Type: text/plain; charset="utf-8" On Sunday 12 August 2007 00.28.07 Jojy Varghese wrote: > Hi all > 3. > I have verified my changes by creating a REDIRECTION rule in the tproxy > chain (can list my iptable changes by doing "iptables -t tproxy -L") Hello, For instance a client try to connect to a webserver somewhere on the Internet listening on port 80, and your proxy is listening on port 50080. The iptables rule that redirects packets to that port is the following: iptables -t tproxy -p tcp --dport 80 -j TPROXY --on-port 50080 The next one is to allow incomming traffic on that port. Because the TPROXY target marks the packet, the following rule accepts these packets: iptables -t filter -A INPUT -m tproxy -j ACCEPT A tutorial is available here: http://www.balabit.hu/network-security/zorp-gateway/gpl/tutorial/ -- Regards, Laszlo Attila Toth ------------------------------ _______________________________________________ tproxy mailing list tproxy(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/tproxy End of tproxy Digest, Vol 26, Issue 11 ************************************** ____________________________________________________________________________________ Shape Yahoo! in your own image. Join our Network Research Panel today! http://surveylink.yahoo.com/gmrs/yahoo_panel_invite.asp?a=7

1 0

Re: [tproxy] tproxy Digest, Vol 26, Issue 11
by Jojy Varghese 13 Aug '07

13 Aug '07

Hi Thanks for your response. I am able to get the traffic redirected to my proxy server port. But the whole behavior is as if the tproxy kernel patch is not applied. In other words, on the web server I see that the request is coming from my proxy server and not from the client. The client IP is not getting rewritten. Any help is much apprciated. thanks again, Jojy ----- Original Message ---- From: "tproxy-request(a)lists.balabit.hu" <tproxy-request(a)lists.balabit.hu> To: tproxy(a)lists.balabit.hu Sent: Monday, August 13, 2007 3:00:05 AM Subject: tproxy Digest, Vol 26, Issue 11 Send tproxy mailing list submissions to tproxy(a)lists.balabit.hu To subscribe or unsubscribe via the World Wide Web, visit https://lists.balabit.hu/mailman/listinfo/tproxy or, via email, send a message with subject or body 'help' to tproxy-request(a)lists.balabit.hu You can reach the person managing the list at tproxy-owner(a)lists.balabit.hu When replying, please edit your Subject line so it is more specific than "Re: Contents of tproxy digest..." Today's Topics: 1. Re: TPROXY + Cisco Firewall (Laszlo Attila Toth) ---------------------------------------------------------------------- Message: 1 Date: Mon, 13 Aug 2007 10:13:15 +0200 From: Laszlo Attila Toth <panther(a)balabit.hu> Subject: Re: [tproxy] TPROXY + Cisco Firewall To: tproxy(a)lists.balabit.hu Message-ID: <200708131013.16001.panther(a)balabit.hu> Content-Type: text/plain; charset="utf-8" On Sunday 12 August 2007 00.28.07 Jojy Varghese wrote: > Hi all > 3. > I have verified my changes by creating a REDIRECTION rule in the tproxy > chain (can list my iptable changes by doing "iptables -t tproxy -L") Hello, For instance a client try to connect to a webserver somewhere on the Internet listening on port 80, and your proxy is listening on port 50080. The iptables rule that redirects packets to that port is the following: iptables -t tproxy -p tcp --dport 80 -j TPROXY --on-port 50080 The next one is to allow incomming traffic on that port. Because the TPROXY target marks the packet, the following rule accepts these packets: iptables -t filter -A INPUT -m tproxy -j ACCEPT A tutorial is available here: http://www.balabit.hu/network-security/zorp-gateway/gpl/tutorial/ -- Regards, Laszlo Attila Toth ------------------------------ _______________________________________________ tproxy mailing list tproxy(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/tproxy End of tproxy Digest, Vol 26, Issue 11 ************************************** ____________________________________________________________________________________ Choose the right car based on your needs. Check out Yahoo! Autos new Car Finder tool. http://autos.yahoo.com/carfinder/

1 0

TPROXY + Cisco Firewall
by Jojy Varghese 13 Aug '07

13 Aug '07

Hi all I am a newbie who is trying to "proxy" using the tproxy patch. I am unable to get the client IP proxied after doing all the changes mentioned on the README file. In short, here are the things i did so far: 1. Applied the kernel patch and compiled it and have it deployed 2. I have done the user space changes of iptables 3. I have verified my changes by creating a REDIRECTION rule in the tproxy chain (can list my iptable changes by doing "iptables -t tproxy -L") 4. Done the code changes as mentioned in the example section of the patch download. After doing all the above steps, when I run my proxy server I dont get a response back at my client. When I "tcpdump" my interface, I see the requests do come but then all of them gets "RST" ed. Now mu traffic goes through a Cisco firewall. Does that have something to do with it? If no, then what are some of the troubleshooting ideas? thanks in advance Jojy ____________________________________________________________________________________ Got a little couch potato? Check out fun summer activities for kids. http://search.yahoo.com/search?fr=oni_on_mail&p=summer+activities+for+kids&…

2 1

tproxy 4.0 & zorp 3.0.8
by Ondrej Kraus 10 Aug '07

10 Aug '07

Hello, I have problems with Zorp 3.0.8 (Debian Etch) with tproxy 4.0.0. I compiled kernel 2.6.22.1 without problems. But then I found that the patch is incomplete. There is file .tproxy-test in iptables patch: #!/bin/sh [ -f $KERNEL_DIR/include/linux/netfilter_ipv4/ipt_TPROXY.h ] && echo TPROXY [ -f $KERNEL_DIR/net/ipv4/netfilter/ipt_tproxy.c ] && echo tproxy Tested files are not included in kernel patch. I found ipt_TPROXY.h in patch for Ubuntu kernel and ipt_TPROXY.c in the same patch, but not ipt_tproxy.c. After successfull compilation (I have changed ipt_tproxy.c in .tproxy-test to ipt_TPROXY.c) I tried to follow README instructions, but system behaves very strangely. # iptables -t tproxy -A PREROUTING -p tcp --dport 80 -j TPROXY --on-port 50080 works well, counters increases as traffic flow thru firewall, but Zorp sees nothing and when I stop Zorp, nothing changes, so I think that everything is just routed. # iptables -A INPUT -m tproxy -j ACCEPT produces 'Invalid argument' and if I add: # iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-dest IP:50080 Zorp gets connection, but it hangs and no connection comes out from firewall. I think that it is obvious that I am new in Zorp/tproxy and these problems might be very trivial to resolve, but I cannot find anything useful to find resolusion. Thank you for any help. Ondrej Kraus

4 9

tproxy4 git repository
by Laszlo Attila Toth 07 Aug '07

07 Aug '07

Hi, The location of TProxy4 repository is: http://people.balabit.hu/panther/tproxy4.git It has two branches: master - latest stable vanilla kernel (now it is 2.6.22) ubuntu-2.6.17-12.39 The git command works (git clone for instance), but a web browser get error 403... -- Regards, Laszlo Attila Toth

2 4

TProxy 4.0.0 with kernel 2.6.22
by Laszlo Attila Toth 06 Aug '07

06 Aug '07

Hi, There is the latest version of tproxy4, it works with Linux kernel 2.6.22. It seems there is no significant difference between 2.6.22 and 2.6.23-rc1, also it should work with 2.6.23-rc1 too. The release tarballs are available here: http://www.balabit.com/downloads/files/tproxy/ MD5 checksums of the tarballs: 990895761bedce8b2e7240cd279fe7be tproxy-4.0.0-2.6.22.tgz d7175531d67beaab48293cd86cac5d21 tproxy-4.0.0-ubuntu-2.6.17-12.39.tgz -- Regards, Laszlo Attila Toth

1 0

bridge + cttpproxy setup
by Ramana Yarlagadda 02 Aug '07

02 Aug '07

Hi there, >From the archives I understand that cttpproxy will work in the bridge mode also. I am trying to implement a layer 7 transparent proxy using ebtables and transparent proxy. Is there are any document available on how to configure the ebtable and iptable rules? I have tried based on my understanding the the client connection request is terminated by the proxy server but the foreign connect from the proxy server to the service ( http server) is failing. The packet is not going out, but is getting re-injected to the local process. The set up is: client <=====> eth0 [ proxy server] eth1- <=======> service/http server can somebody help me on this issue. -Thanks in advance -Ramana

2 1