- tproxy - lists.balabit.hu

TPROXY - Hotmail, Yahoo!, and Facebook not working
by Pablo Armando 11 Feb '11

11 Feb '11

Hello, I am new in this list; I hope that I can make the right questions. I have configured TPROXY (with SQUID 3.1 and SQUID 2.7.STABLE9) and i can _not_ browse hotmail (i can login, but nothing else), yahoo and facebook AFAIK. I _can_ browse all other sites without problems, HTTPS sites included. I tried http://squidproxy.wordpress.com/2008/04/29/chunked-decoding/, but the problems remains. Adding these lines to the standard TPROXY firewall rules let me get partially hotmail access, full access to yahoo, and, some times, partial facebook access: -------------- iptables -A PREROUTING -t mangle -p tcp -d login.live.com --dport 80 -j ACCEPT iptables -A PREROUTING -t mangle -p tcp -s login.live.com --dport 80 -j ACCEPT iptables -A PREROUTING -t mangle -p tcp -d mail.live.com --dport 80 -j ACCEPT iptables -A PREROUTING -t mangle -p tcp -s mail.live.com --dport 80 -j ACCEPT iptables -A PREROUTING -t mangle -p tcp -d co117w.col117.mail.live.com--dport 80 -j ACCEPT iptables -A PREROUTING -t mangle -p tcp -s co117w.col117.mail.live.com--dport 80 -j ACCEPT iptables -A PREROUTING -t mangle -p tcp -d l.yimg.com --dport 80 -j ACCEPT iptables -A PREROUTING -t mangle -p tcp -s l.yimg.com --dport 80 -j ACCEPT iptables -A PREROUTING -t mangle -p tcp -d l1.yimg.com --dport 80 -j ACCEPT iptables -A PREROUTING -t mangle -p tcp -s l1.yimg.com --dport 80 -j ACCEPT iptables -A PREROUTING -t mangle -p tcp -d d.yimg.com --dport 80 -j ACCEPT iptables -A PREROUTING -t mangle -p tcp -s d.yimg.com --dport 80 -j ACCEPT iptables -A PREROUTING -t mangle -p tcp -d www.facebook.com --dport 80 -j ACCEPT iptables -A PREROUTING -t mangle -p tcp -s www.facebook.com --dport 80 -j ACCEPT -------------- The problem with this approach is that there are a lot of domains involved, and a lot of IPs ranges. It is not practical at all. I really don’t know which could be the problem. If I use SQUID directly (http_port 3128 and browser configuration) I can access all those sites without any problem, but when socket interception is enable, something happen and those sites become unavailable. What can be happening here? Any of you have seen these problems? How can i resolve this situation? Thanks in advance and sorry for my poor English. Pablo.

1 0

tproxy on firewall redirecting to squid located on different ip on same subnet
by Ivan Boyadzhiev 23 Jan '11

23 Jan '11

Hi Colleagues, First I would like to thank you for the great Tproxy that you've made. The idea of marking the packets and no changing of ip header is brilliant! I've read all information about tproxy. The most useful pages were: http://wiki.squid-cache.org/Features/Tproxy4 http://www1.shorewall.net/Shorewall_Squid_Usage.html#TPROXY still there is documented how to use tproxy when the Firewall (Gateway) and Squid are on the same machine. In my case I do have 2 different servers, for Firewall (and Gateway) and Squid. The Firewall or Gateway doesn't permit any traffic to external internet. And everyone who wants internet has to setup proxy setting of the Squid server, which is in same subnet. My question is: is it possible to use TPROXY for redirecting such traffic to the squid. If so, can you provide some useful example that I can apply in my case. Thanks again and Best Regards Ivan Boyadzhiev

3 2

Re: [tproxy] tproxy for ipv6
by Balazs Scheidler 06 Jan '11

06 Jan '11

Hi, The latest versions got integrated into 2.6.37 last October. On Thu, 2011-01-06 at 14:51 +0530, maria isabel wrote: > Hi, > Can you please give me the patch which has TPROXY for IPV6?I have my > own NAT modules for IPV6.Also can you also give me the pyhton script > to test tproxy for both ipv4 and ipv6. > I got your contact from this link. > > http://lwn.net/Articles/349958/ > > Regards, > Maria -- Bazsi

1 0

Kamran Sarkary invited you to Dropbox
by Dropbox 09 Dec '10

09 Dec '10

Kamran Sarkary wants you to use Dropbox to sync and share files online and across computers. Get started here: http://www.dropbox.com/link/20.cEwLdnMHlM/NjUxODE2NjExNw?src=referrals_bulk0 - The Dropbox Team ____________________________________________________ To stop receiving invites from Dropbox, please go to http://www.dropbox.com/bl/f3de8fd47703/tproxy%40lists.balabit.hu

1 0

tproxy for locally originating connections
by Adriel Gomboc 03 Dec '10

03 Dec '10

Hello, I am new to the list, and couldn't find this discussed in the archives: I would like to use tproxy to proxy locally originating connections (on Linux). AFAIK there is a problem with doing this : the tproxy target is only valid in the mangle table, in the prerouting chain; and locally originating traffic (i.e. traffic originating from some client application running on the same host as the tproxy service) does not pass through the prerouting chain and presumably therefore cannot be tproxied. May I ask, am I right in the above, and if so, can anyone offer a work-around? Kind regards, Adriel Gomboc

2 1

Tproxy Bandwidth limit
by Luiz Biazus 13 Nov '10

13 Nov '10

hello guys, Is it true that tproxy has a bandwidth limit of 80mb/s on linux? bst rgds Luiz

3 3

Re: [tproxy] tproxy Digest, Vol 64, Issue 1
by hugo＠gigared.com 10 Nov '10

10 Nov '10

Dear Mr Biazus: i tested Tproxy patch under linux (2.6.31.6-166) up to 180Mbps. pay attention on the amount of sockets permitted by your tcp config. in linux are under the sysctl.conf , to reach a reasonable bandwith , i have these settings: net.ipv4.netfilter.nf_conntrack_max = 131070 net.ipv4.netfilter.nf_conntrack_expect_max = 131070 net.ipv4.netfilter.ip_conntrack_tcp_timeout_estabilished=600 net.ipv4.netfilter.ip_conntrack_udp_timeout=60 net.ipv4.netfilter.ip_conntrack_udp_timeout_stream=180 net.netfilter.nf_conntrack_max = 131070 net.netfilter.nf_conntrack_expect_max = 131070 net.netfilter.ip_conntrack_tcp_timeout_estabilished=600 net.netfilter.ip_conntrack_udp_timeout=60 net.netfilter.ip_conntrack_udp_timeout_stream=180 >From whoses that dont know or dont like to recompile the kernel , i have it compiled in a rpm for Fedora 12, and the versions 3.1.0.14/3.1.8/3.1.9 of squid patched in rpm format too. i dont post the link to download due my personal server bandwith limitations but from who needs i have those files as the instructions for installing to Regards, Hugo Petrucci Mensaje citado por tproxy-request(a)lists.balabit.hu: > Send tproxy mailing list submissions to > tproxy(a)lists.balabit.hu > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.balabit.hu/mailman/listinfo/tproxy > or, via email, send a message with subject or body 'help' to > tproxy-request(a)lists.balabit.hu > > You can reach the person managing the list at > tproxy-owner(a)lists.balabit.hu > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of tproxy digest..." > > > Today's Topics: > > 1. Tproxy Bandwidth limit (Luiz Biazus) > 2. Re: Kernel Panic/System Hang when using TPROXY with 2.6.27 or > later (KOVACS Krisztian) > 3. Re: Tproxy Bandwidth limit (KOVACS Krisztian) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 8 Nov 2010 20:53:15 -0200 > From: Luiz Biazus <luiz(a)biazus.com> > Subject: [tproxy] Tproxy Bandwidth limit > To: tproxy(a)lists.balabit.hu > Message-ID: > <AANLkTimBWR0tDWca00KWABczF0QOrXfrrGyO2SOwQy+v(a)mail.gmail.com> > Content-Type: text/plain; charset=ISO-8859-1 > > hello guys, > > > Is it true that tproxy has a bandwidth limit of 80mb/s on linux? > > > bst rgds > > Luiz > > > ------------------------------ > > Message: 2 > Date: Tue, 09 Nov 2010 07:47:10 +0100 > From: KOVACS Krisztian <hidden(a)balabit.hu> > Subject: Re: [tproxy] Kernel Panic/System Hang when using TPROXY with > 2.6.27 or later > To: FREY Oliver <FREY.O(a)ikarus.at> > Cc: tproxy(a)lists.balabit.hu > Message-ID: <1289285230.4570.6.camel(a)nienna.balabit> > Content-Type: text/plain; charset="UTF-8" > > Hey Oliver, > > On Thu, 2010-10-28 at 10:26 +0200, FREY Oliver wrote: > > sorry for my late reply, we had some delays in compiling and deploying the > kernel. > > I took the diffs from the Website and created a .patch-File which then > could be applied to to the vanilla 2.6.35.7-Kernel-Source without issues - is > there a more efficient way to retrieve all the diffs for a commit in one > file? > > Sure, you can get the whole patch as-is via the web interface. > > This is the patch you want: > http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h… > > You can get a .patch file containing all the fixes related to these > files by clicking on the 'patch' link at the top of the page: > > http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=patch;h=… > > > Are there any CONFIG_DEBUG-options you can recommend to be set just in case > we run into issues again, or to see if there are any issues left? > > Well, apart from enabling linked list debugging and SLUB debugging I > don't think any of those would be of much use. > > > As the machines previously never survived more than 72 hours without > crashing, by next week I will definitely know if the issue is fixed, and I'll > report back then. > > For now, thanks for your great and very quick support! > > Do you have any update on this? How did your testing go? > > Cheers, > Krisztian > > > > > ------------------------------ > > Message: 3 > Date: Tue, 09 Nov 2010 07:49:03 +0100 > From: KOVACS Krisztian <hidden(a)balabit.hu> > Subject: Re: [tproxy] Tproxy Bandwidth limit > To: Luiz Biazus <luiz(a)biazus.com> > Cc: tproxy(a)lists.balabit.hu > Message-ID: <1289285343.4570.8.camel(a)nienna.balabit> > Content-Type: text/plain; charset="UTF-8" > > Hi, > > On Mon, 2010-11-08 at 20:53 -0200, Luiz Biazus wrote: > > Is it true that tproxy has a bandwidth limit of 80mb/s on linux? > > I don't think that's true -- I'd definitely consider that to be a > problem that should be fixed as soon as possible. > > Cheers, > Krisztian > > > > > ------------------------------ > > _______________________________________________ > tproxy mailing list > tproxy(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/tproxy > > > End of tproxy Digest, Vol 64, Issue 1 > ************************************* > ------------------------- www.gigared.com

1 0

Re: [tproxy] Kernel Panic/System Hang when using TPROXY with 2.6.27 or later
by KOVACS Krisztian 10 Nov '10

10 Nov '10

Hi, On Tue, 2010-11-09 at 08:54 -0800, Ken Simpson wrote: > >> sorry for my late reply, we had some delays in compiling and deploying the kernel. > >> I took the diffs from the Website and created a .patch-File which then could be applied to to the vanilla 2.6.35.7-Kernel-Source without issues - is there a more efficient way to retrieve all the diffs for a commit in one file? > > > > Sure, you can get the whole patch as-is via the web interface. > > > > This is the patch you want: > > http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h… > > Quick question: now that the patch is in Linus' kernel tree, does this mean it will appear in a mainline kernel release soon? How does that process work? It has been merged in Linus' tree after 2.6.36 was released and it was already present in 2.6.37-rc1, so 2.6.37 will be the first stable release with the patch (and IPv6 support in tproxy) included. Cheers, Krisztian

1 0

Re: [tproxy] Kernel Panic/System Hang when using TPROXY with 2.6.27 or later
by KOVACS Krisztian 09 Nov '10

09 Nov '10

Hey Oliver, On Thu, 2010-10-28 at 10:26 +0200, FREY Oliver wrote: > sorry for my late reply, we had some delays in compiling and deploying the kernel. > I took the diffs from the Website and created a .patch-File which then could be applied to to the vanilla 2.6.35.7-Kernel-Source without issues - is there a more efficient way to retrieve all the diffs for a commit in one file? Sure, you can get the whole patch as-is via the web interface. This is the patch you want: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h… You can get a .patch file containing all the fixes related to these files by clicking on the 'patch' link at the top of the page: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=patch;h=… > Are there any CONFIG_DEBUG-options you can recommend to be set just in case we run into issues again, or to see if there are any issues left? Well, apart from enabling linked list debugging and SLUB debugging I don't think any of those would be of much use. > As the machines previously never survived more than 72 hours without crashing, by next week I will definitely know if the issue is fixed, and I'll report back then. > For now, thanks for your great and very quick support! Do you have any update on this? How did your testing go? Cheers, Krisztian

1 0

Re: [tproxy] Easiest way to install tproxy on Ubuntu 10.04 for regular laymen users
by SM 23 Oct '10

23 Oct '10

Yes, it is!! Awesome. From the README.txt file, I was of the opinion that the kernel needs to be patched and compiled. I have the following scenario: All UDP packets *coming in and going out* of port 5060 need to be redirected to port 56789. An application running on port 56789 must parse them, modify them and send them to their intended destinations. I must take care that packets coming from remote machine to local machine:5060 are FIRST received at local machine:56789, and then, after modification, sent to local machine:5060 with a spoofed header suggesting that it came from remote machine. The incoming packets can be handled by this rule: iptables -t mangle -A PREROUTING -p udp --dport 5060 -j TPROXY --on-port 56789 --tproxy-mark 0x1/0x1 How should I handle the outgoing packets for 5060? Mangle table's OUTPUT rule does not take tproxy as a target. Thanks for your reply. --SM. On Fri, Oct 22, 2010 at 11:31 PM, Ken Simpson <ksimpson(a)mailchannels.com>wrote: > TProxy is built into the kernel in 10.04. > > On 2010-10-22, at 9:27 PM, SM wrote: > > > Hello, > > > > I was wondering what is the easiest way to install tproxy on Ubuntu > 10.04, instead of compiling the kernel after patching it. Is there any way > of accomplishing the same thing by kernel modules? Thank you for your early > response. > > > > Regards, > > SM. > > _______________________________________________ > > tproxy mailing list > > tproxy(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/tproxy > > Regards, > Ken > > -- > Ken Simpson > CEO, MailChannels > > www.mailchannels.com > > T +1 888 685 7488 > >

2 1