Re: [tproxy] Easiest way to install tproxy on Ubuntu 10.04 for regular laymen users
Yes, it is!! Awesome. From the README.txt file, I was of the opinion that the kernel needs to be patched and compiled. I have the following scenario: All UDP packets *coming in and going out* of port 5060 need to be redirected to port 56789. An application running on port 56789 must parse them, modify them and send them to their intended destinations. I must take care that packets coming from remote machine to local machine:5060 are FIRST received at local machine:56789, and then, after modification, sent to local machine:5060 with a spoofed header suggesting that it came from remote machine. The incoming packets can be handled by this rule: iptables -t mangle -A PREROUTING -p udp --dport 5060 -j TPROXY --on-port 56789 --tproxy-mark 0x1/0x1 How should I handle the outgoing packets for 5060? Mangle table's OUTPUT rule does not take tproxy as a target. Thanks for your reply. --SM. On Fri, Oct 22, 2010 at 11:31 PM, Ken Simpson <ksimpson@mailchannels.com>wrote:
TProxy is built into the kernel in 10.04.
On 2010-10-22, at 9:27 PM, SM wrote:
Hello,
I was wondering what is the easiest way to install tproxy on Ubuntu 10.04, instead of compiling the kernel after patching it. Is there any way of accomplishing the same thing by kernel modules? Thank you for your early response.
Regards, SM. _______________________________________________ tproxy mailing list tproxy@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/tproxy
Regards, Ken
-- Ken Simpson CEO, MailChannels
www.mailchannels.com
T +1 888 685 7488
On Sat, 2010-10-23 at 00:09 -0500, SM wrote:
Yes, it is!! Awesome. From the README.txt file, I was of the opinion that the kernel needs to be patched and compiled.
I have the following scenario:
All UDP packets coming in and going out of port 5060 need to be redirected to port 56789. An application running on port 56789 must parse them, modify them and send them to their intended destinations. I must take care that packets coming from remote machine to local machine:5060 are FIRST received at local machine:56789, and then, after modification, sent to local machine:5060 with a spoofed header suggesting that it came from remote machine.
The incoming packets can be handled by this rule: iptables -t mangle -A PREROUTING -p udp --dport 5060 -j TPROXY --on-port 56789 --tproxy-mark 0x1/0x1
How should I handle the outgoing packets for 5060? Mangle table's OUTPUT rule does not take tproxy as a target.
in order to spoof UDP source addresses in packets towards the localhost, you don't need a TPROXY target. you need to modify the proxy to set the setsockopt IP_TRANSPARENT, bind the socket towards the local host to the address of the client and then use sendto() Also, please note that this will only work if your traffic is unidirectional (e.g. you only send a frame and never receive one) because the response packets generated by the local stack will not be redirected by tproxy, thus they'll go directly to the original client. Frames sent to the server & redirected by TPROXY: client -> proxy -> local server Reverse direction, frames sent by the server to the client: local server -> client E.g. the proxy will never receive these frames. This is why TCP will _not_ work towards the local host. If you want that, you need to use NAT, which reroutes traffic properly. Also, although TPROXY is compiled into Ubuntu 10.04, but we've just posted UDP fixes to mainline (see netfilter-devel archives). You may or may not be affected, I just wanted to tell that there are fixes not yet in your kernel. -- Bazsi
participants (2)
-
Balazs Scheidler
-
SM