- tproxy - lists.balabit.hu

./configure --enable-linux-netfilter
by Mamadou Touré 16 Aug '10

16 Aug '10

hi, when configuring squid-3.0.14 with --enable-linux-netfilter and i got this error: configure:27511: checking for linux/netfilter_ipv4/ip_tproxy.h configure:27565: g++ -c -g -O2 conftest.cpp >&5 conftest.cpp:33:1: warning: "USE_DISKIO_AIO" redefined conftest.cpp:30:1: warning: this is the location of the previous definition conftest.cpp:34:1: warning: "USE_DISKIO_DISKTHREADS" redefined conftest.cpp:31:1: warning: this is the location of the previous definition conftest.cpp:169:44: error: linux/netfilter_ipv4/ip_tproxy.h: No such file or directory configure:27572: $? = 1 configure: failed program was: can some one tell me how to solve. regards.

2 1

bridge + Squid + Tproxy
by Mamadou Touré 12 Aug '10

12 Aug '10

Hi all, i've implemented squid with tproxy on a linux bridge for transparent proxy of my clients . Internet-----router------squid(bridge)-----Router-------client i've made these config: +++++++++++++++++++++++++++++++++++++++++++++++ ip rule add fwmark 1 lookup 100 ip route add local 0.0.0.0/0 dev lo table 100 echo 0 > /proc/sys/net/ipv4/conf/lo/rp_filter echo 1 > /proc/sys/net/ipv4/ip_forward iptables -t mangle -N DIVERT iptables -t mangle -A DIVERT -j MARK --set-mark 1 iptables -t mangle -A DIVERT -j ACCEPT iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 3129 ebtables -t broute -A BROUTING -i $CLIENT_IFACE -p ipv4 --ip-proto tcp --ip-dport 80 -j redirect --redirect-target DROP cd /proc/sys/net/bridge/ for i in * do echo 0 > $i done unset i +++++++++++++++++++++++++++++++++++++++++++++++++++++ But my client cannot browse on internet in access log i got TCP_MISS/504 error. can someone help me ? regards

1 0

Re: [tproxy] Squid, TPROXY and SquidGuard
by Mamadou Touré 09 Aug '10

09 Aug '10

Notice that when i'm not in TPROXY mode ie standaard acces on port 3128. access are logged in access.log and my contents are filtered. this may meen that there is no probleme with squidGuard Config and squid. the problem may be with TPROXY. when configuring Squid-3 source as: ./configure --enable-linux-netfilter In the config log I can see : error: linux/netfilter_ipv4/ip_tproxy.h: No such file or directory Is this normal ? regards.

1 0

Squid, TPROXY and SquidGuard
by Mamadou Touré 09 Aug '10

09 Aug '10

hi all i'm about to implement a transparent content filtering using squid tproxy and squidGuard. I've tried this: squid.conf: ++++++++++++++++++++++++++++++++++++++++++++ http_port 3129 tproxy redirect_program /usr/local/bin/squidGuard -c /usr/local/squidGuard/squidGuard.conf -d redirect_children 10 +++++++++++++++++++++++++++++++++++++++++++++++++ my squidGuard.conf +++++++++++++++++++++++++++++++++++++++++++++++++++++ ..... dest porn { domainlist porn/domains urllist porn/urls expressionlist porn/expressions redirect http://localhost/denied.bl } acl { winxp_1 { pass !porn any } default { pass any } } ...... +++++++++++++++++++++++++++++++++++++++++++++++++++ HTTP traffic are redirect with: +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 3129 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ I think that My traffic passthrougth squid. Because my LAN machine can browse Internet. But the contents are not filtered because the user can access porn site. Also access are not logged in access.log. Does some one already implement such config ? Can someone help me? regards.

2 1

Re: [tproxy] smtp-gated
by Tamer Mohamed 09 Jun '10

09 Jun '10

Dears, I have installed kernel 2.6.30.1 with iptables v1.4.3.2 with software called smtp-gated (smtp proxy listening on port 9199) software. I have applied the below rules to the firelwall: iptables -t mangle -N DIVERT iptables -t mangle -A PREROUTING -p tcpo -m socket -j DIVERT iptables -t mangle -A DIVERT -j MARK --set-xmark 0x1/0xffffffff iptables -t mangle -A DIVERT -j ACCEPT iptables -t mangle -A PREROUTING -p tcp --dport 25 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 9199 but when I initiate a connection to the machine on port 25 nothing gets redirected to the 9199 port. What could be possibly the problem. Regards, Tamer Mohamed

1 0

Fwd: [squid-users] Squid + Tproxy + Bridge on Kernel 2.6.34 - Workaround
by Vivek 26 May '10

26 May '10

FYI - -------- Original Message -------- Subject: [squid-users] Squid + Tproxy + Bridge on Kernel 2.6.34 - Workaround Date: Wed, 26 May 2010 09:51:39 +0530 From: senthilkumaar2021 <senthilkumaar2021(a)gmail.com> To: squid-users(a)squid-cache.org CC: netfilter(a)vger.kernel.org Hi, Squid + Tproxy + Bridge Setup on latest kernel - version 2.6.34 I had followed all the steps that had given in the http://wiki.squid-cache.org/Features/Tproxy4 Kernel - 2.6.34 iptable - 1.4.8 ebtable - 2.0.9-1 But clients were unable to browse and no errors in cache.log. Error - Network Unreachable. The error had returned by browser not squid proxy. Workaround :- After adding the following rules, clients are able to browse. # ip rule add dev<device name> fwmark 1 lookup 100 example # ip rule add dev eth0 fwmark 1 lookup 100 NOTE : Repeat the above for each interface except " lo " Source -https://lists.balabit.hu/pipermail/tproxy/2010-January/001212.html Based on the above source this issue had identified on kernel version - 2.6.32. But still not yet fixed. I have CC ed this mail to netfilter mailing lists also. Hope this helps Thanks, Senthil

3 2

Tproxy + DNS + OpenDNS = Borked
by Tristram Cheer 20 May '10

20 May '10

Hey Guys, After getting tproxy running on a server that handles a dozen or so of our clients I've run into an interesting problem that I'm having issue with fixing. Some of our clients use openDNS to filter porn websites but when TPROXY is in use they client can still access it, I've figured out that its because the TPROXY server is looking up the DNS directly, I cant change the server to use openDNS with the clients account because a number of clients using openDNS use it aswell. Is there anyway to get squid and TPROXY to spoof DNS requests to show as coming from the client IP and not cache the result? Cheers Tristram

2 3

Fwd: IPTables or EBTables Causing Kernel Panics
by Tristram Cheer 03 May '10

03 May '10

Hi, Attached is the screenshot of the panic. Thanks On 2 May 2010 07:04, KOVACS Krisztian <hidden(a)sch.bme.hu> wrote: > Hi, > > On Sat, 2010-05-01 at 13:11 +1200, Tristram Cheer wrote: > > We use Slackware 13.0 in bridge mode with no nat or anything with > > Squid 3.1 and Tproxy using kernel 2.6.31 and during peak loads the box > > kernel panics with error about the bridge. > > > > When the IPtables and EBtables rules are dropped so the box is acting > > just as a bridge without caching it's stable. > > > > Does anyone know what would be causing this? > > Do you happen to have the panic output? That piece of information would > be very handy. (Either a picture of the screen with the message or a the > kernel log captured using something like a serial console would be > useful.) > > Cheers, > Krisztian > >

2 2

IPTables or EBTables Causing Kernel Panics
by Tristram Cheer 01 May '10

01 May '10

Hey guys, We use Slackware 13.0 in bridge mode with no nat or anything with Squid 3.1 and Tproxy using kernel 2.6.31 and during peak loads the box kernel panics with error about the bridge. When the IPtables and EBtables rules are dropped so the box is acting just as a bridge without caching it's stable. Does anyone know what would be causing this? Regards Tristram

2 1

help me!plz!
by 王琳 16 Apr '10

16 Apr '10

Hello all I try to implement haproxy in transparent mode like in http://blog.loadbalancer.org/configure-haproxy-with-tproxy-kernel-for-full-… I add rules in iptables, but when I try to access to the service, the result is “503 Service Unavailable”. Without the line “source 0.0.0.0 usesrc clientip” all works correctly, obviously without transparency. Have you got any ideas? Where I’m wrong? Thanks!

1 0