Check that the userspace application enables IP_TRANSPARENT on the listening socket. You can do that via strace. Tproxy will only match listener sockets with that flag set. -- Bazsi On May 20, 2014 6:11:00 PM CEST, Tiago <sytker@gmail.com> wrote:
Hello,
Usage: Apache Trafficserver (web cache) fully transparent using tproxy
OS: Ubuntu 12.04
I’m trying to setup this:
My Router / firewall which has:
- port 23 (customer network, which has gateway x.x.x.x)
- port2 (traffic server cache, which has IP y.y.y.y and bound to 8080 port).
PS: The web cache has only one ethernet interface (eth2).
- ISPs (internet links) connected to the router.
My router has:
1) Policy routes in place redirecting all requests from customer network with destination port 80 via port2 to apache traffic server.
2) Policy routes in place redirecting all answers from ISPs (from source port 80) via port2 to apache traffic server.
When a customer access any website, those packets are being sent to the web cache. But nothing else happens (except timeout).
My modules:
lsmod
Module Size Used by
nf_nat 25891 2 ipt_REDIRECT,iptable_nat
nf_conntrack_ipv4 19716 3 iptable_nat,nf_nat
nf_conntrack 81926 3 iptable_nat,nf_nat,nf_conntrack_ipv4
iptable_filter 12810 0
xt_tcpudp 12603 1
xt_TPROXY 12853 0
nf_tproxy_core 12610 1 xt_TPROXY,[permanent]
xt_socket 12715 0
nf_defrag_ipv4 12729 3 nf_conntrack_ipv4,xt_TPROXY,xt_socket
ip6_tables 27864 2 xt_TPROXY,xt_socket
nf_defrag_ipv6 13368 2 xt_TPROXY,xt_socket
xt_mark 12563 2
iptable_mangle 12734 1
ip_tables 27473 3 iptable_nat,iptable_filter,iptable_mangle
x_tables 29846 10 ipt_REDIRECT,iptable_nat,iptable_filter,xt_tcpudp,xt_TPROXY,xt_socket,ip6_tables,xt_mark,iptable_mangle,ip_tables
btrfs 652957 0
Linux options:
echo 1 > /proc/sys/net/ipv4/ip_forward
echo 0 > /proc/sys/net/ipv4/conf/default/rp_filter
echo 0 > /proc/sys/net/ipv4/conf/all/rp_filter
echo 0 > /proc/sys/net/ipv4/conf/eth2/rp_filter
echo 1 > /proc/sys/net/ipv4/conf/eth2/proxy_arp
Iptables Rules:
iptables -t mangle -N DIVERT
iptables -t mangle -A DIVERT -j MARK --set-mark 1
iptables -t mangle -A DIVERT -j ACCEPT
iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT
iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 8080
ip rule add fwmark 1 lookup 100
ip route add local 0.0.0.0/0 dev lo table 100
Apache traffic server debug when trying to access www.inter.com.ve:
tcpdump -ni eth2 host 200.8.57.5
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth2, link-type EN10MB (Ethernet), capture size 65535 bytes
03:48:27.880413 IP x.x.x.5.53663 > 200.8.57.5.80: Flags [S], seq 2084747082, win 65535, options [mss 1440,nop,wscale 4,nop,nop,TS val 903707860 ecr 0,sackOK,eol], length 0
03:48:28.882079 IP x.x.x.5.53663 > 200.8.57.5.80: Flags [S], seq 2084747082, win 65535, options [mss 1440,nop,wscale 4,nop,nop,TS val 903708860 ecr 0,sackOK,eol], length 0
03:48:29.885816 IP x.x.x.5.53663 > 200.8.57.5.80: Flags [S], seq 2084747082, win 65535, options [mss 1440,nop,wscale 4,nop,nop,TS val 903709861 ecr 0,sackOK,eol], length 0
03:48:30.991950 IP x.x.x.5.53663 > 200.8.57.5.80: Flags [S], seq 2084747082, win 65535, options [mss 1440,nop,wscale 4,nop,nop,TS val 903710959 ecr 0,sackOK,eol], length 0
03:48:32.000267 IP x.x.x.5.53663 > 200.8.57.5.80: Flags [S], seq 2084747082, win 65535, options [mss 1440,nop,wscale 4,nop,nop,TS val 903711960 ecr 0,sackOK,eol], length 0
03:48:33.105923 IP x.x.x.5.53663 > 200.8.57.5.80: Flags [S], seq 2084747082, win 65535, options [mss 1440,nop,wscale 4,nop,nop,TS val 903713058 ecr 0,sackOK,eol], length 0
03:48:35.117941 IP x.x.x.5.53663 > 200.8.57.5.80: Flags [S], seq 2084747082, win 65535, options [mss 1440,nop,wscale 4,nop,nop,TS val 903715059 ecr 0,sackOK,eol], length 0
03:48:39.638357 IP x.x.x.5.53663 > 200.8.57.5.80: Flags [S], seq 2084747082, win 65535, options [mss 1440,sackOK,eol], length 0
03:48:48.030197 IP x.x.x.5.53663 > 200.8.57.5.80: Flags [S], seq 2084747082, win 65535, options [mss 1440,sackOK,eol], length 0
^C
9 packets captured
9 packets received by filter
0 packets dropped by kernel
Debug when trying:
telnet www.inter.com.ve 80
Trying 200.8.57.5...
Its not responding to syn packets, but I'm lost what I need to do to fix this.
About trafficserver, I'm using their guide http://docs.trafficserver.apache.org/en/latest/admin/transparent-proxy/route...
Any help?
Thank you
------------------------------------------------------------------------
_______________________________________________ tproxy mailing list tproxy@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/tproxy