Hello, I have configured a transparent HTTP proxy using Iptables and Zorp but It does not work. *SYSTEM INFO:* *loop@santeles:~$ uname -a Linux santeles 2.6.31-19-server #56-Ubuntu SMP Thu Jan 28 02:39:34 UTC 2010 x86_64 GNU/Linux loop@santeles:~$ iptables -V iptables v1.4.4 root@santeles:/home/loop# zorpctl version Zorp 3.0.8 Revision: Compile-Date: May 4 2009 04:17:42 Config-Date: 2009/05/04 Trace: off Debug: off IPOptions: off IPFilter-Tproxy: off Netfilter-Tproxy: on Netfilter-Linux22-Fallback: on Linux22-Tproxy: off Conntrack: on Zorplib 3.0.6.4.2 Revision: devel@balabit.hu--zorp-1/zorp-lib--mainline--3.0--patch-116 Compile-Date: Nov 9 2009 09:50:26 Trace: off MemTrace: off Caps: on Debug: off StackDump: off **SYSTEM CONFIG: root@santeles:/home/loop# ifconfig -a** dummy0 Link encap:Ethernet HWaddr 00:21:9b:ee:61:14 inet addr:1.2.3.4 Bcast:1.255.255.255 Mask:255.255.255.255 inet6 addr: fe80::24c4:26ff:fec7:914/64 Scope:Link UP BROADCAST MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:3 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:0 (0.0 B) TX bytes:210 (210.0 KB) wlan0 Link encap:Ethernet HWaddr 00:1f:3b:6d:30:9b inet addr:10.1.1.2 Bcast:10.1.1.255 Mask:255.255.255.0 inet6 addr: fe80::226:18ff:fef2:31bc/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:14 errors:0 dropped:0 overruns:0 frame:0 TX packets:2910 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:900 (900.0 B) TX bytes:1692 (1.6 KB) Interrupt:27 Base address:0x8000 lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:16436 Metric:1 RX packets:4 errors:0 dropped:0 overruns:0 frame:0 TX packets:4 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:368 (368.0 B) TX bytes:368 (368.0 B) root@santeles:/home/loop# cat /etc/iproute2/rt_tables # # reserved values # 255 local 254 main 253 default 200 proxy 0 unspec # # local # #1 inr.ruhep root@santeles:/home/loop# ip rule list 0: from all lookup local 32765: from all fwmark 0x01 lookup proxy 32766: from all lookup main 32767: from all lookup default root@santeles:/home/loop# ip route show table proxy local default dev dummy0 scope host * * root@santeles:/home/loop# cat /etc/zorp/instances.conf secret -v10 -p /etc/zorp/policy.py --autobind-ip 1.2.3.4 --tproxy netfilter root@DPP3-GREC:/home/evalues# cat /etc/zorp/policy.py from Zorp.Core import * from Zorp.Plug import * from Zorp.Http import * Zorp.firewall_name = 'DPP3-GREC' InetZone("secret-net", "0.0.0.0/0", outbound_services=["*"], inbound_services=["*"]) def secret(): Service("serv", HttpProxy ) Listener(SockAddrInet("1.2.3.4",50080), "serv") * * iptables rules* * iptables -t mangle -P PREROUTING ACCEPT iptables -t mangle -N DIVERT iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT iptables -t mangle -A DIVERT -j MARK --set-mark 1 iptables -t mangle -A DIVERT -j ACCEPT iptables -t mangle -A PREROUTING -p tcp --dport 80 -j LOG --log-prefix "Passing request to proxy" --log-level debug iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --on-ip 1.2.3.4 --tproxy-mark 1 --on-port 50080 iptables -t mangle -P OUTPUT ACCEPT iptables -P INPUT ACCEPT iptables -P FORWARD ACCEPT iptables -P OUTPUT ACCEPT * *IPTABLES IS LOADED CORRECTLY * *root@DPP3-GREC:/home/evalues# iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination LOG all -- anywhere anywhere LOG level debug prefix `Input' Chain FORWARD (policy ACCEPT) target prot opt source destination LOG all -- anywhere anywhere LOG level debug prefix `Forward' Chain OUTPUT (policy ACCEPT) target prot opt source destination LOG all -- anywhere anywhere LOG level debug prefix `Output' root@DPP3-GREC:/home/evalues# iptables -t mangle -L Chain PREROUTING (policy ACCEPT) target prot opt source destination DIVERT tcp -- anywhere anywhere socket LOG tcp -- anywhere anywhere tcp dpt:www LOG level debug prefix `Passing request to proxy' TPROXY tcp -- anywhere anywhere tcp dpt:www TPROXY redirect 1.2.3.4:50080 mark 0x1/0xffffffff Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain POSTROUTING (policy ACCEPT) target prot opt source destination Chain DIVERT (1 references) target prot opt source destination MARK all -- anywhere anywhere MARK xset 0x1/0xffffffff ACCEPT all -- anywhere anywhere **ZORP STARTS WITHOUT PROBLEM* *root@DPP3-GREC:/home/evalues# zorpctl start Starting Zorp Firewall Suite: secret root@DPP3-GREC:/home/evalues# netstat -a -p | grep zorp tcp 0 0 1.2.3.4:50080 *:* LISTEN 1700/zorp unix 2 [ ACC ] STREAM LISTENING 8096 1700/zorp /var/run/zorp/zorpctl.secret unix 2 [ ] DGRAM 8094 1700/zorp unix 2 [ ] DGRAM 8090 1699/zorpctl superv root@DPP3-GREC:/home/evalues# tail -n 18 /var/log/syslog Mar 1 17:10:42 DPP3-GREC secret[1734]: (noname/nosession): Starting up; verbose_level='10', version='3.0.8' Mar 1 17:10:42 DPP3-GREC secret[1734]: (noname/nosession): System dependant init; sysdep_tproxy='tproxy12' Mar 1 17:10:42 DPP3-GREC secret[1734]: (szig): thread starting; Mar 1 17:10:42 DPP3-GREC secret[1734]: (szig): Start to listen; fd='8', address='AF_UNIX(/var/run/zorp/zorpctl.secret)' Mar 1 17:10:42 DPP3-GREC secret[1734]: (Log thread): thread starting; Mar 1 17:10:42 DPP3-GREC secret[1734]: (conntrack/thread): thread starting; Mar 1 17:10:42 DPP3-GREC secret[1734]: (Log thread): /usr/lib/python2.4/whrandom.py:38: DeprecationWarning: the whrandom module is deprecated; please use the random module#012 Mar 1 17:10:42 DPP3-GREC secret[1734]: (Log thread): DeprecationWarning)#012 Mar 1 17:10:42 DPP3-GREC secret[1734]: (noname/nosession): Outbound service; zone='secret-net', service='*' Mar 1 17:10:42 DPP3-GREC secret[1734]: (noname/nosession): Inbound service; zone='secret-net', service='*' Mar 1 17:10:42 DPP3-GREC secret[1734]: (secret@DPP3-GREC): Dispatcher on address; proto='1', local='AF_INET(1.2.3.4:50080)', prio='100' Mar 1 17:10:42 DPP3-GREC secret[1734]: (secret@DPP3-GREC): Start to listen; fd='14', address='AF_INET(1.2.3.4:50080)' Mar 1 17:10:42 DPP3-GREC secret[1734]: (secret@DPP3-GREC/nosession): read blob systems default attributes; tmpdir='/var/lib/zorp/tmp/', max_disk_usage='1073741824', max_mem_usage='268435456', lowat='100663296', hiwat='134217728', noswap_max='16384' Mar 1 17:10:42 DPP3-GREC secret[1734]: (secret@DPP3-GREC/nosession): creating blob management thread; Mar 1 17:10:42 DPP3-GREC secret[1734]: (secret@DPP3-GREC/nosession): blob management thread starting; Mar 1 17:10:42 DPP3-GREC secret[1734]: (secret@DPP3-GREC/nosession): blob management thread signalling back to constructor; Mar 1 17:10:42 DPP3-GREC secret[1734]: (secret@DPP3-GREC/nosession): waiting for the queue; Mar 1 17:10:42 DPP3-GREC secret[1734]: (secret@DPP3-GREC/nosession): blob management thread up and running; * *HOWEVER, IPTABLES FORWARDS THE HTTP PACKETs TO THE PROXY, BUT THE PROXY DOES NOT RECEIVE ANYTHING* *root@DPP3-GREC:/home/evalues# tail -n 10 /var/log/syslog Mar 1 17:10:42 DPP3-GREC secret[1734]: (secret@DPP3-GREC): Start to listen; fd='14', address='AF_INET(1.2.3.4:50080)' Mar 1 17:10:42 DPP3-GREC secret[1734]: (secret@DPP3-GREC/nosession): read blob systems default attributes; tmpdir='/var/lib/zorp/tmp/', max_disk_usage='1073741824', max_mem_usage='268435456', lowat='100663296', hiwat='134217728', noswap_max='16384' Mar 1 17:10:42 DPP3-GREC secret[1734]: (secret@DPP3-GREC/nosession): creating blob management thread; Mar 1 17:10:42 DPP3-GREC secret[1734]: (secret@DPP3-GREC/nosession): blob management thread starting; Mar 1 17:10:42 DPP3-GREC secret[1734]: (secret@DPP3-GREC/nosession): blob management thread signalling back to constructor; Mar 1 17:10:42 DPP3-GREC secret[1734]: (secret@DPP3-GREC/nosession): waiting for the queue; Mar 1 17:10:42 DPP3-GREC secret[1734]: (secret@DPP3-GREC/nosession): blob management thread up and running; Mar 1 17:14:08 DPP3-GREC kernel: [ 5253.789761] Passing request to proxyIN=eth0 OUT= MAC=00:26:18:f2:31:bc:00:60:97:ba:c0:53:08:00 SRC=10.0.1.2 DST=10.0.2.5 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=55686 DF PROTO=TCP SPT=44711 DPT=80 WINDOW=5840 RES=0x00 SYN URGP=0 Mar 1 17:14:11 DPP3-GREC kernel: [ 5256.789037] Passing request to proxyIN=eth0 OUT= MAC=00:26:18:f2:31:bc:00:60:97:ba:c0:53:08:00 SRC=10.0.1.2 DST=10.0.2.5 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=55687 DF PROTO=TCP SPT=44711 DPT=80 WINDOW=5840 RES=0x00 SYN URGP=0 Mar 1 17:14:17 DPP3-GREC kernel: [ 5262.786612] Passing request to proxyIN=eth0 OUT= MAC=00:26:18:f2:31:bc:00:60:97:ba:c0:53:08:00 SRC=10.0.1.2 DST=10.0.2.5 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=55688 DF PROTO=TCP SPT=44711 DPT=80 WINDOW=5840 RES=0x00 SYN URGP=0 * Any idea of what can be happening? Thanks in advance