- tproxy - lists.balabit.hu

Easiest way to install tproxy on Ubuntu 10.04 for regular laymen users
by SM 23 Oct '10

23 Oct '10

Hello, I was wondering what is the easiest way to install tproxy on Ubuntu 10.04, instead of compiling the kernel after patching it. Is there any way of accomplishing the same thing by kernel modules? Thank you for your early response. Regards, SM.

1 0

Tproxy , wccp and squid
by hugo＠gigared.com 21 Oct '10

21 Oct '10

Dear people: I receive many mails about using Tproxy4 , wccpv2 and squid that config really works fine , with tested traffic up to 180Mbps. and is Stable , working 7x24 in the last year , first with squid version 3.1.0.14 a now with 3.1.8. Some minor problems when , for many reasons (spoofing, attacks, etc) the squid looses performances (for ex, from 80 to 20Mbps) the wccp do not derive the traffic direct to the internet until the network interface to the wccp-in is deactivated. but this is a rare situation (once or twice a month) i think that the mayor contribution to this application is to test in the real environ , passing to you all the info about. regarding , obviously, the economical contribution that the ISP that uses must do. in short again : if someone need more info about deployment, testing, etc etc , i think is better to do via this forum, in order to share the info with all of us. Thank you again Hugo ------------------------- www.gigared.com

1 0

Re: [tproxy] Kernel Panic/System Hang when using TPROXY with 2.6.27 or later
by KOVACS Krisztian 21 Oct '10

21 Oct '10

Hi, On Thu, 2010-10-21 at 16:16 +0200, FREY Oliver wrote: > Our product supports either proxying using iptables-REDIRECT-targets and > no TPROXY, or using iptables-TPROXY-targets and the TPROXY-support to > open the outgoing connection with the client's IP-address. > > Everything is working fine and systems are stable and running for months > when using the REDIRECT-targets. > Also everything looks to run fine when using the TPROXY-targets, but > unfortunately within 24-48 hours the system either hangs with a Kernel > Panic (we can also see some Soft-Lockup-Warnings before that) or > completely hangs, needing a manual reset. > Unfortunately we have no Kernel-development/debugging experience, but > all the warnings/panics point to kernel-memory-corruption, because by > now we had panics in virtually any system-function called that tries to > allocate/free kernel-memory - also once we had a Kernel with > slab-debug-messages enabled running and got messages that corruption was > detected, hours before the system finally paniced. > > The latest kernel we tried was 2.6.35.2, we also tried a few versions in > between, but stability did not change. > At application-level there is not much that has to be done (and can get > wrong) to use TPROXY-support, and the calls were implemented according > to sample-code. > > I do appreciate any help you can provide, as I've run out of ideas what > I could do to fix the issue. Well, there was a report of tproxy-triggered crashes on the linux netdev mailing list a few months ago. It might be the case that you're experiencing the same issue, but it's impossible to tell without knowing more details. We do have a patch which should fix that particular problem so maybe it would be worth giving that patch a try. You can get the patch here: http://git.balabit.hu/?p=hidden/tproxy-2.6.git;a=commit;h=4ccf010bd58417458… Please let me know if you're still having issues after applying the patch. Cheers, Krisztian

1 0

tproxy for ipv6
by Manila Goel 21 Oct '10

21 Oct '10

hi all, For ipv4 we hv written a tproxy code using NAT table. I want it do for ipv6 but NAT table doest support ipv6. If anyone has done any wrk on this. if anyone can give some idea, i will be greatfull for me. Thanks Mona -- :)

2 2

bypassing squid via iptables
by hugo＠gigared.com 21 Oct '10

21 Oct '10

hi all! im using tproxy on fedora 12 (kernel 2.6.31-6) with squid 3.1.8 on a wccp configuration using a cisco 3560. everything works really fine , except for some newly appeared web sites (or something like that) that abuses on http 1.1, and cause many customers requests. failed. in short: can i really bypass squid and send these requests directly to the internet? i believe that this is possible changing the pre-post routings rules of iptables and , giving the ip of the websites Thank you in advance. my sh executing iptables actual config : #!/bin/sh # squid server IP SQUID_SERVER="192.168.250.9" # Interface connected to LAN LAN_IN="eth5" # Interface connected to Internet INTERNET="eth7" # DO NOT MODIFY BELOW # Clean old firewall iptables -F iptables -X iptables -t nat -F iptables -t nat -X iptables -t mangle -F iptables -t mangle -X # ip rule add fwmark 1 lookup 100 ip route add local 0.0.0.0/0 dev lo table 100 # # Setting default filter policy iptables -P INPUT ACCEPT iptables -P OUTPUT ACCEPT # ############################################### # # TPROXY 4 Rules - router # ############################################## # #Setup a chain DIVERT to mark packets # iptables -t mangle -N DIVERT iptables -t mangle -A DIVERT -j MARK --set-mark 1 iptables -t mangle -A DIVERT -j ACCEPT ############################################### # # TPROXY 4 Rules - bridge # ############################################## # # Use DIVERT to prevent existing connections # going through TPROXY twice: # # iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT # # Mark all other (new) packets and use TPROXY to pass into Squid: # # iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 3129 # # iptables -A INPUT -i gre0 -j ACCEPT # iptables -A INPUT -p gre -j ACCEPT # # # ebtables -t broute -A BROUTING -i $LAN_IN -p ipv4 --ip-proto tcp --ip-dport 80 -j redirect --redirect-target DROP # # ebtables -t broute -A BROUTING -i $INTERNET -p ipv4 --ip-proto tcp --ip-sport 80 -j redirect --redirect-target DROP # # # # # cd /proc/sys/net/bridge/ for i in * do echo 0 > $i done unset i # ip ro flu ca ------------------------- www.gigared.com

1 0

Java & TPROXY
by Simon James 19 Oct '10

19 Oct '10

Hi Is it possible to combine use of TPROXY with a server written in Java? I cannot find a way of setting the IP_TRANSPARENT socket option from within Java. Regards Simon

2 1

IPv6 Tproxy?
by Tristram Cheer 02 Sep '10

02 Sep '10

Hey Guys, Does anyone have tproxy working with ipv6?? Trying to run it, We have v4 working fine but v6 isnt being detected 2010/09/03 00:04:58.275| http(s)_port: found Listen on Port: 3129 2010/09/03 00:04:58.275| http(s)_port: found Listen on wildcard address: *:3129 2010/09/03 00:04:58.275| Starting IP Spoofing on port [::]:3129 2010/09/03 00:04:58.275| Disabling Authentication on port [::]:3129 (IP spoofing enabled) 2010/09/03 00:04:58.275| Detect TPROXY support on port [::]:3129 2010/09/03 00:04:58.275| ...Probing for IPv6 TPROXY support. 2010/09/03 00:04:58.275| ...Probing for IPv4 TPROXY support. 2010/09/03 00:04:58.275| IPv4 TPROXY support detected. Using. 2010/09/03 00:04:58.275| Processing: 'hierarchy_stoplist cgi-bin ?' I have all the v6 stuff setup on the box but dont know why squid isnt detecting TPROXY support. Any ideas? Cheers

2 1

Tproxy troubleshooting
by Angelo Compagnucci 27 Aug '10

27 Aug '10

Hi List, I'll try to understang what's not working in my setup. I'm trying to configure tproxy on an lan but I cannot get it working. I'll try to explain better. My setup is resumed in the following scheme: LAN --> TRPOXY + BRIDGE + SQUID --> Default gateway. I'm working on Ubuntu 9.10 with Squid 3.1. Squid and tproxy are correctly configured because I can read "Accepting spoofing http connections at ..." in chache.log. The configuration I set up is described at the page http://wiki.squid-cache.org/Features/Tproxy4. This is the script i use to configure everithing: CLIENT_IFACE=eth0 INET_IFACE=eth1 ifconfig $CLIENT_IFACE down ifconfig $INET_IFACE down ifconfig $CLIENT_IFACE 0.0.0.0 up ifconfig $INET_IFACE 0.0.0.0 up brctl addbr br0 brctl addif br0 $CLIENT_IFACE brctl addif br0 $INET_IFACE brctl stp br0 off dhclient br0 ip rule add fwmark 1 lookup 100 ip route add local 0.0.0.0/0 dev lo table 100 echo 0 > /proc/sys/net/ipv4/conf/lo/rp_filter echo 1 > /proc/sys/net/ipv4/ip_forward iptables -t mangle -N DIVERT iptables -t mangle -A DIVERT -j MARK --set-mark 1 iptables -t mangle -A DIVERT -j ACCEPT iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 3129 ebtables -t broute -A BROUTING -i $CLIENT_IFACE -p IPv4 --ip-proto tcp --ip-dport 80 -j redirect --redirect-target DROP ebtables -t broute -A BROUTING -i $INET_IFACE -p IPv4 --ip-proto tcp --ip-sport 80 -j redirect --redirect-target DROP cd /proc/sys/net/bridge/ for i in * do echo 0 > $i done unset i With this configuration TPROXY doesn't work, I can see packet count increase for TRPOXY target in iptables -L but nothing appears on access.log and every http request from clients times out. This configuration works when I change --redirect-target DROP to --redirect-target ACCEPT, but in this case I can observe a duplication on traffic un port 80 inspecting my gateway traffic flow. I'm really gratefull to anyoune that can help me. Angelo

1 0

Ziproxy with Tproxy problem-- Client IP spoofing does not work
by Masih Nilforoushan 26 Aug '10

26 Aug '10

Hi folks, I have implemented Ziproxy for HTTP compression and web acceleration on Ubuntu 9 with Kernel 2.6.35.3. I compiled the Kernel for tproxy and Socket match and implemented iptables with socket andredirect rules along with Iproute2 commands. I need to spoof the client IP addresses so that remote web servers can see the clients real IP addresses rather than Ziproxy's IP address. I couldn't find any specific document on the Internet stating that Ziproxy is compatible with tproxy. However, I compiled and installed everything from scratch without any errors. But the problem is that when I add the following lines into iptables, my ziproxy does not respond to clients request any more and they can browse anything. iptables -t mangle -N DIVERT iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT iptables -t mangle -A DIVERT -j MARK --set-mark 1 iptables -t mangle -A DIVERT -j ACCEPT iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 8080 I traced the problem and find out that my box does not operate with tproxy. When it receives the clients request , it doesn't respond and doesn't open any socket towards the remote server. Can anybody please tell me if Ziproxy supports tproxy and IP spoofing? If it supports, what is wrong with my implementation? Thanks, Masih

1 0

problem with Hotmail and Facebook
by Carlos Botejara 23 Aug '10

23 Aug '10

Hello. I comment a bit my scenario I suando fedora core 11, LUSCA_HEAD-r14733 squid, dnsmasq the server is serving about 800 users, with a bandwidth of 60 MB. This server works in bridge mode with PUBLIC IP. The problem is that since the first days of August, I received complaints from users who can not enter HOTMAIL then validate your data, I mean that HOTMAIL cover charge, but when you validate the data, the connection and left hanging after a few minutes an error that says Connection reset by peer. And with Facebook, but can access the site, validate and review messages / photos, etc, is never loaded the list of online contacts, therefore the user can not chat. Not so with the pages of banks, or gmail, they have their chat embedded in the site. I make this clarification because any of the above sites, work with HTTPS. Reading this forum, make a tag mension within the SERVER_HTTP11 squid is ON. Place this option in my squid.conf, but got no positive results. has happened to someone? any ideas?.

1 0