- tproxy - lists.balabit.hu

tproxy to increase the number of connections
by maria isabel 22 Feb '13

22 Feb '13

Hello, Is it possible to use tproxy with strongswan ipsec? and increase the number of connections in a linux box?Currently there is a limitation of 20000 connections in strongswan. Regards, Maria

2 1

I'm having a little trouble binding a tproxy and I might do something wrong.
by Eliezer Croitoru 05 Feb '13

05 Feb '13

Hello, I am writing a small proxy and while trying to use tproxy I am getting a problem while I am not sure I am doing it right. The server accepts the connection and identify the two ends. But when I try to connect using the client IP and PORT I am getting error "Connection timed out - connect(2)" while on netstat I am getting two sockets: tcp 0 1 192.168.10.100:51573 81.218.79.155:80 SYN_SENT tcp 287 0 81.218.79.155:80 192.168.10.100:51573 ESTABLISHED The upper one is the server "connect" which seems to stuck like that with no response. This problem accrues only when I try to bind the same ip and port of the client. When I use other random port as src port for the forged connection I can connect and everything is fine. I might be doing something wrong but since I have no clue. I am using ruby and the basic code: #!/usr/bin/ruby require 'socket' server = Socket.new(Socket::AF_INET,Socket::SOCK_STREAM) server.setsockopt(Socket::SOL_SOCKET, Socket::SO_REUSEADDR, true) server.setsockopt(Socket::SOL_SOCKET, Socket::SO_BROADCAST, true) server.setsockopt(Socket::SOL_IP, 19, 1) server_port = Socket.pack_sockaddr_in( 1111, '0.0.0.0') result = server.bind(server_port) server.listen(10) puts "server started with code: #{result}" while (connection = server.accept) Thread.new(connection) do |conn| puts "new connection" port, host = Socket.unpack_sockaddr_in conn[1] client = "#{host}:#{port}" puts "#{client} is connected" local_address = (Socket.unpack_sockaddr_in conn[0].local_address) + [conn[0].local_address.ipv4?] remote_address = (Socket.unpack_sockaddr_in conn[0].remote_address) + [conn[0].remote_address.ipv4?] puts "local_address: #{local_address}" puts "remote_address: #{remote_address}" fake_local = Socket.pack_sockaddr_in(0,remote_address[1]) if local_address[2] remote_connection = Socket.new(Socket::AF_INET,Socket::SOCK_STREAM,0) remote_connection.setsockopt(Socket::SOL_IP, Socket::IP_TRANSPARENT, 1) result = remote_connection.bind(conn[0].remote_address) puts "Bind result: #{result}" else remote_connection = Socket.new(Socket::AF_INET6,Socket::SOCK_STREAM,0) remote_connection.setsockopt(Socket::SOL_IP, Socket::IP_TRANSPARENT, 1) result = remote_connection.bind(conn[0].remote_address) puts "Bind result: #{result}" end begin puts "Server Connect result: #{remote_connection.connect(conn[0].local_address)}" rescue => e puts e.exception puts e.message end end end ##end of file The output from the server is: server started with code: 0 new connection 192.168.10.100:51573 is connected local_address: [80, "81.218.79.155", true] remote_address: [51573, "192.168.10.100", true] Bind result: 0 Connection timed out - connect(2) Connection timed out - connect(2) Thanks, Eliezer

2 5

tproxy routing issue within processes in the same machine
by Ming-Ching Tiew 19 Sep '12

19 Sep '12

tproxy has problem working within 2 processes on the same machine, ie a client process using tproxy to spoof an IP, has problem communicating with the server process within the same machine. It seems tproxy attaches itself to mangle table PREROUTING chain, that is unable to hook to the in-machine process. I figured that for it to work, in this case, it needs to be able to attach itself to the INPUT chain. However that hook is not supported. Is there a way to get around this problem ?

3 4

TProxy on localhost
by Karol 'Cubix' Piłat 14 Jul '12

14 Jul '12

Hello, Is it possible to spoof TCP connection's source address on localhost using TProxy and IP_TRANSPARENT socket option? I am trying to do it for few hours now, but connection stalled on SYN_SENT. Same configuration works in LAN, when my tproxy virtual machine is set as default gateway for other host. I tried many sysctl and routing options, but nothing works. Best Regards, Karol Pilat -- The age of features is dead; Welcome to the age of User Experience.

1 0

tproxy 4.1 squid 3.1.19 not working for yahoo mail
by Ming-Ching Tiew 13 Jul '12

13 Jul '12

I am using linux kernel 3.2.21 ( also tested a few other versions ). Basically I could get basic tproxy working by following this instruction. http://wiki.squid-cache.org/Features/Tproxy4 Everything I follow strictly except rp_filter I have to set to zero. Then I could visit some website and it seems tproxy is working. However I have problem with one or two website, yahoo mail in particular, which is not working well. I wonder if this is the forum which I could post some follow details in troubleshooting the problem ? The symptom of the problem is slow in login and impossible to logout from yahoo mail. The browser complains of zero byte received. 2012/07/01 20:08:50.410| The request GET http://mail.yahoo.com/ is ALLOWED, because it matched 'localnet' 2012/07/01 20:08:50.416| client_side_request.cc(556) clientAccessCheck2: No adapted_http_access configuration. 2012/07/01 20:08:50.416| The request GET http://mail.yahoo.com/ is ALLOWED, because it matched 'localnet' 2012/07/01 20:08:54.899| connReadWasError: FD 9: got flag -1 2012/07/01 20:08:54.904| ConnStateData::swanSong: FD 9 2012/07/01 20:08:55.490| The request GET http://us.mc1614.mail.yahoo.com/mc/welcome?.gx=1&.tm=1341173241&.rand=foctj… is ALLOWED, because it matched 'localnet' 2012/07/01 20:08:55.501| client_side_request.cc(556) clientAccessCheck2: No adapted_http_access configuration. 2012/07/01 20:08:55.501| The request GET http://us.mc1614.mail.yahoo.com/mc/welcome?.gx=1&.tm=1341173241&.rand=foctj… is ALLOWED, because it matched 'localnet' 2012/07/01 20:10:10.020| connReadWasError: FD 9: got flag -1 2012/07/01 20:10:10.027| ConnStateData::swanSong: FD 9 2012/07/01 20:10:10.072| connReadWasError: FD 20: got flag -1 2012/07/01 20:10:10.079| connReadWasError: FD 18: got flag -1 2012/07/01 20:10:10.080| connReadWasError: FD 22: got flag -1 2012/07/01 20:10:10.080| connReadWasError: FD 10: got flag -1 2012/07/01 20:10:10.081| ConnStateData::swanSong: FD 20 2012/07/01 20:10:10.082| ConnStateData::swanSong: FD 18 2012/07/01 20:10:10.082| ConnStateData::swanSong: FD 22 2012/07/01 20:10:10.084| ConnStateData::swanSong: FD 10 2012/07/01 20:10:10.096| The request GET http://mail.yahoo.com/ is ALLOWED, because it matched 'localnet' 2012/07/01 20:10:10.096| client_side_request.cc(556) clientAccessCheck2: No adapted_http_access configuration. 2012/07/01 20:10:10.096| The request GET http://mail.yahoo.com/ is ALLOWED, because it matched 'localnet' 2012/07/01 20:10:16.984| ctx: exit level 0 2012/07/01 20:10:16.992| WARNING: HTTP: Invalid Response: No object data received for http://mail.yahoo.com/ AKA mail.yahoo.com/ 2012/07/01 20:10:16.994| fwdServerClosed: FD 10 http://mail.yahoo.com/ 2012/07/01 20:10:23.515| ctx: exit level 0 2012/07/01 20:10:23.521| WARNING: HTTP: Invalid Response: No object data received for http://mail.yahoo.com/ AKA mail.yahoo.com/ 2012/07/01 20:10:23.523| fwdServerClosed: FD 10 http://mail.yahoo.com/ 2012/07/01 20:10:29.892| ctx: exit level 0 2012/07/01 20:10:29.899| WARNING: HTTP: Invalid Response: No object data received for http://mail.yahoo.com/ AKA mail.yahoo.com/ 2012/07/01 20:10:29.901| fwdServerClosed: FD 10 http://mail.yahoo.com/ 2012/07/01 20:10:29.915| The reply for GET http://mail.yahoo.com/ is ALLOWED, because it matched 'all'

2 2

I wonder missing ip_tproxy.h header file and tproxy
by sungjin o 14 May '12

14 May '12

hello, i'm korean so im sorry my english text written my environment is the latest Centos and network doing bridge. my option is already setted by using information on internet my problem is that squid 2.7 setting "--enable-linux-tproxy" causes below warning.. --------------------------------------- --------------------------------------- checking if Linux (Netfilter) kernel header files are installed... no WARNING: Cannot find necessary Linux kernel (Netfilter) header files Linux Transparent Proxy support WILL NOT be enabled checking if TPROXY header files are installed... no --------------------------------------- --------------------------------------- my wordering is that although tproxy is intergrated with latest kernel source, there is not ip_tproxy.h i have known that ip_tproxy.h was provided from obsolete kernel source patch in "balabit.com" but why do squid2.7 need ip_tproxy.h? so, i downloaded ip_tproxy.h and compiled squid2.7 by using the ip_tproxy.h and i setted option "http_port 3128 tproxy" in squid.conf. after compiling and setting, the squid is running but the tproxy doesn't work. i setted iptables rules following below --------------------------------------------------------------------- ---------- setsebool squid_connect_any=1** setsebool squid_use_tproxy=1 iptables -t mangle -N DIVERT iptables -t mangle -A DIVERT -j MARK --set-mark 1 iptables -t mangle -A DIVERT -j ACCEPT iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 3128 --------------------------------------------------------------------- ---------- i must use tproxy in squid 2.7 environment. could you help me? please..

2 1

tproxy and IPv6
by WG 23 Apr '12

23 Apr '12

Hi, I'm trying to redirect all IPv6 traffic entering eth0 on port 80 to a locally running proxy server. But for some reason, the remote client gets only a connection timeout. I do see traffic entering eth0 to port 80, but nothing happens. This is what I did : ip -f inet6 rule add fwmark 1 lookup 100 ip -f inet6 route add local ::/0 dev lo table 100 ip6tables -t mangle -N DIVERT ip6tables -t mangle -A PREROUTING -p tcpo -m socket -j DIVERT ip6tables -t mangle -A DIVERT -j MARK --set-xmark 0x1/0xffffffff ip6tables -t mangle -A DIVERT -j ACCEPT ip6tables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 3128 Any ideas why it doesn't actually connect to port 3128 ? I tried using --on-ip as well, but no difference. Thanks for any help ! Wim

4 4

Tproxy Freeebsd 8.2 stable
by hrd tribima 27 Nov '11

27 Nov '11

Hi All, Does anyone have any success installing Tproxy on Freebsd 8.2 with lusca or cach I already googling and read http://tproxy.no-ip.org/ and still no luck freebsd 8.2 LUSCA_HEAD-r14809 ipfw 1 ethernet card I could really use some advice. Thanks! Toni

1 0

TIME_WAIT / LAST_ACK Problem
by Simon James 18 Nov '11

18 Nov '11

Hi I am experiencing an intermittent but quite frequent problem when load testing a transparent proxy (squid) (with 100's of connections). I would welcome any advice on what I might be doing wrong. The end result is that there are lot of: * server-side connections left in TIME_WAIT state * client-side connections left in LAST_ACK state I am using Iptables to: * redirect/tproxy incoming port 80 traffic to port 3129 * set a mark on outgoing port 80 traffic (for routing) I also use the TRACE target in the raw table to log the packet paths. The problem seems to arise when the server initiates the close of the connection. In that case, the trace output shows: 1. the FIN from the server passing through the mangle:OUTPUT, filter:OUTPUT and filter:POSTROUTING tables 2. a FIN/ACK from the client arriving and passing through mangle:PREROUTING, mangle:INPUT and filter:INPUT tables 3. a final ACK from the server passing through the mangle:OUTPUT tables but getting no further. Steps 2 & 3 are repeated as the client resends its unacknowledged FIN. I am attaching the packet trace for one instance of this problem, extracted from /var/log/messages. I have used tcpdump on both client and server and confirmed that the final ACK never leaves the server. I have enabled logging of invalid packets, but am not seeing any reports. This problem is happening on Fedora 14 - 2.6.35.14-103.fc14.x86_64, with iptables v1.4.9. I don't see the problem with non-transparent connections. I am also attaching iptables rules for the mangle table and tcp-related sysctl settings. Regards Simon

2 3

Apache TProxy; proxy: error binding to socket
by Dariush Zahedmanesh 15 Oct '11

15 Oct '11

Hello All I want to use apache-2.2.14 web server as a transparent proxy in ip layer on freebsd-7.0. I configured it with following scenario: Client1 Apache TProxy Configured web server 172.20.13.43 ---------------- [em0:172.20.13.196, 192.168.100.101:em1] --------------------192.168.100.102 My httpd.conf on Tproxy is: .... Listen 4129 <VirtualHost 172.20.13.196:4129> ServerName 172.20.13.196 ProxyRequests off ProxyTProxy On ProxyPass / http://192.168.100.102/ ProxyPassReverse / http://192.168.100.102/ ProxyPreserveHost On </VirtualHost> I used ipnat for trrafic redirection by following configuration. /etc/ipnat.conf: rdr em0 192.168.100.102/32 port 80 -> 172.20.13.196 port 4129 tcp when i request http://192.168.100.102 on web client1, i recieve following error on web browser: Service Temporarily Unavailable The server is temporarily unable to service your request due to maintenance downtime or capacity problems. Please try again later. My apache error log is: [Sat Oct 15 11:59:45 2011] [debug] mod_proxy_http.c(56): proxy: HTTP: canonicalising URL //192.168.100.102/ [Sat Oct 15 11:59:45 2011] [debug] proxy_util.c(1494): [client 172.20.13.43] proxy: http: found worker http://192.168.100.102/ for http://192.168.100.102/ [Sat Oct 15 11:59:45 2011] [debug] mod_proxy.c(993): Running scheme http handler (attempt 0) [Sat Oct 15 11:59:45 2011] [debug] mod_proxy_http.c(1940): proxy: HTTP: serving URL http://192.168.100.102/ [Sat Oct 15 11:59:45 2011] [debug] proxy_util.c(1999): proxy: HTTP: has acquired connection for (192.168.100.102) [Sat Oct 15 11:59:45 2011] [debug] proxy_util.c(2055): proxy: connecting http://192.168.100.102/ to 192.168.100.102:80 [Sat Oct 15 11:59:45 2011] [debug] proxy_util.c(2153): proxy: connected / to 192.168.100.102:80 [Sat Oct 15 11:59:45 2011] [error] (22)Invalid argument: proxy: *error binding *to socket 172.20.13.43:4536 [Sat Oct 15 11:59:45 2011] [debug] proxy_util.c(2017): proxy: HTTP: has released connection for (192.168.100.102) How i can fix it? Any help would be great. -- Best regards Dariush Zahedmanesh

1 0