Gday

 

Hello one of my server FC11 x64 bit running Tproxy with combination of iptables + ebtables rules during peek hours machine was rash with given such as error "kernel panic " . when i replace tproxy with netfilter and remove ebtables rules just use simple iptables with NAT rules everything was fine. anyone faced this issue before ?  find below my configuration

 

 

 

 

Kernel =2.6.29.6-217.2.8.fc11.x86_64

O/S= FC 11 x64 Intel based

iptables= v1.4.3.1

ebtables= v2.0.9-1

 

firewall.conf

 

#!/bin/sh

IPTABLES=/sbin/iptables
EBTABLES=/sbin/ebtables

EXTDEV="eth0"
INTDEV="eth1"
SERVERIP="xxx.xxx.xxx.15"

${EBTABLES} -t broute -F
${EBTABLES} -t broute -A BROUTING -i $EXTDEV -p ipv4 --ip-protocol tcp --ip-source-port 80 -j redirect --redirect-target DROP
${EBTABLES} -t broute -A BROUTING -i $INTDEV -p ipv4 --ip-protocol tcp --ip-destination-port 80 -j redirect --redirect-target DROP

 

${IPTABLES} -F
${IPTABLES} -F -t nat
${IPTABLES} -F -t mangle

${IPTABLES} -v -t mangle -N DIVERT
${IPTABLES} -v -t mangle -A DIVERT -j MARK --set-mark 1
${IPTABLES} -v -t mangle -A DIVERT -j ACCEPT

${IPTABLES} -v -t mangle -A PREROUTING -p tcp -m socket -j DIVERT
${IPTABLES} -v -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 3129

 

${IPTABLES} -I INPUT -s $SERVERIP -i br0 -j REJECT

${IPTABLES} -A INPUT -m state --state INVALID -j DROP
${IPTABLES} -A INPUT -s xxx.xxx.xxx.0/24 -j ACCEPT
${IPTABLES} -I INPUT -i lo -j ACCEPT
${IPTABLES} -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
${IPTABLES} -A INPUT -j DROP

 

ip rule add fwmark 1 lookup 100
ip route add local 0.0.0.0/0 dev lo table 100

sysctl -w net.ipv4.ip_nonlocal_bind=1
sysctl -w net.ipv4.ip_forward=1