Sziasztok, probalom a zorp 3.9.2-t mukodesre birni. Alapjaban mar majdnem minden megy, csak az url redirect nem. Az alabbi konfig file-ok eseten, bizonyos oldalakra valoban a www.balabit.hu jon be (pl www.mta.hu), viszont szamos esetben az eredeti oldal (pl index.hu) hibajelzessel (a kert oldal nem talalhato). Mi lehet a hiba? Koszonom, tusi policy.py: from Zorp.Core import * from Zorp.Plug import * from Zorp.Http import * from Zorp.Proxy import * Zorp.firewall_name = 'fal' InetZone("out", "0.0.0.0/0", inbound_services=[ "in_out_http",\ ], outbound_services=[ ]) InetZone("in", "172.16.0.0/16", inbound_services=[ ], outbound_services=[ "in_out_http",\ ]) class MyHttpProxy(HttpProxy): def config(self): HttpProxy.config(self) self.request["GET"] = (HTTP_REQ_POLICY, self.filterURL) def filterURL(self, method, url, version): self.request_url = "http://www.balabit.hu/" return HTTP_REQ_ACCEPT def in2out_http(): Service(name="in_out_http", proxy_class=MyHttpProxy, router=TransparentRouter()) Dispatcher(bindto=DBIface(protocol=ZD_PROTO_TCP, iface="eth1", ip="172.16.0.254", port=50080), service="in_out_http", transparent=TRUE, threaded=FALSE, backlog=255) --------------------------------------------- instances.conf: in2out_http --log-tags --verbose 2 -p /etc/zorp/policy.py -------------------------------------------- iptables -L: Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED ACCEPT all -- anywhere anywhere LOintra all -- 172.16.0.0/16 anywhere Chain FORWARD (policy DROP) target prot opt source destination LOG all -- anywhere anywhere LOG level warning prefix `DROP FORWARD:' DROP all -- anywhere anywhere Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain LOintra (1 references) target prot opt source destination -------------------------------------------- iptables -t mangle -L: Chain PREROUTING (policy ACCEPT) target prot opt source destination PRio all -- 172.16.0.0/16 anywhere Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain POSTROUTING (policy ACCEPT) target prot opt source destination Chain PRio (1 references) target prot opt source destination TPROXY tcp -- anywhere anywhere tcp dpt:www TPROXY redirect 172.16.0.254:50080 mark 0x1/0x1 -------------------------------------------- zorpctl version: Zorp 3.9.2 Revision: ssh+git://coroner@git.balabit//var/scm/git/zorp/zorp-core--mainline--4.0#master#c52537337d6add922cdb65a04767d8a74b2eef12 Compile-Date: Sep 2 2011 18:19:46 Config-Date: 2011/09/02 Trace: off Debug: off IPOptions: off IPFilter-Tproxy: off Netfilter-Tproxy: on Linux22-Tproxy: off libzorpll 3.9.1.0 Revision: Compile-Date: Sep 2 2011 13:48:33 Trace: off MemTrace: off Caps: on Debug: off StackDump: off ------------------------------------------ 6-os loglevelen cliens http://index.hu-t keri: Mar 13 17:43:24 fal zorp/in2out_http[10007]: core.debug(6): (dsp/dispatch:0): Incoming connection; protocol='1', remote='AF_INET(172.16.7.61:47962)', local='AF_INET(217.20.130.97:80)', dest='AF_INET(217.20.130.97:80)' Mar 13 17:43:24 fal zorp/in2out_http[10007]: core.session(5): (svc/in_out_http): Starting service; name='in_out_http' Mar 13 17:43:24 fal zorp/in2out_http[10007]: core.session(3): (svc/in_out_http:9): Starting proxy instance; client_fd='21', client_address='AF_INET(172.16.7.61:47962)', client_zone='Zone(in, 172.16.0.0/16)', client_local='AF_INET(217.20.130.97:80)', client_protocol='TCP' Mar 13 17:43:24 fal zorp/in2out_http[10007]: core.session(5): (svc/in_out_http:9/http): Proxy starting; class='MyHttpProxy', proxy='http' Mar 13 17:43:24 fal zorp/in2out_http[10007]: core.debug(6): (dsp/dispatch:0): Incoming connection; protocol='1', remote='AF_INET(172.16.7.61:47963)', local='AF_INET(217.20.130.97:80)', dest='AF_INET(217.20.130.97:80)' Mar 13 17:43:24 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:9/http): thread starting; Mar 13 17:43:24 fal zorp/in2out_http[10007]: core.session(5): (svc/in_out_http): Starting service; name='in_out_http' Mar 13 17:43:24 fal zorp/in2out_http[10007]: core.session(3): (svc/in_out_http:10): Starting proxy instance; client_fd='22', client_address='AF_INET(172.16.7.61:47963)', client_zone='Zone(in, 172.16.0.0/16)', client_local='AF_INET(217.20.130.97:80)', client_protocol='TCP' Mar 13 17:43:24 fal zorp/in2out_http[10007]: core.session(5): (svc/in_out_http:10/http): Proxy starting; class='MyHttpProxy', proxy='http' Mar 13 17:43:24 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:9/http): Attribute changed; attribute='language', newvalue=''en'' Mar 13 17:43:24 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:9/http): Attribute fetched; attribute='ssl', value='ZPolicyStruct object type Shared' Mar 13 17:43:24 zorp/in2out_http[10007]: last message repeated 7 times Mar 13 17:43:24 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:9/http): Attribute fetched; attribute='request', value='<Zorp hash object at 0x7f216a486a08>' Mar 13 17:43:24 zorp/in2out_http[10007]: last message repeated 3 times Mar 13 17:43:24 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:9/http): Attribute fetched; attribute='ssl', value='ZPolicyStruct object type Shared' Mar 13 17:43:24 zorp/in2out_http[10007]: last message repeated 2 times Mar 13 17:43:24 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:9/http): Fetching request and headers; Mar 13 17:43:24 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:10/http): thread starting; Mar 13 17:43:24 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:10/http): Attribute changed; attribute='language', newvalue=''en'' Mar 13 17:43:24 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:10/http): Attribute fetched; attribute='ssl', value='ZPolicyStruct object type Shared' Mar 13 17:43:24 zorp/in2out_http[10007]: last message repeated 7 times Mar 13 17:43:24 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:10/http): Attribute fetched; attribute='request', value='<Zorp hash object at 0x7f216a486aa8>' Mar 13 17:43:24 zorp/in2out_http[10007]: last message repeated 3 times Mar 13 17:43:24 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:10/http): Attribute fetched; attribute='ssl', value='ZPolicyStruct object type Shared' Mar 13 17:43:24 zorp/in2out_http[10007]: last message repeated 2 times Mar 13 17:43:24 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:10/http): Fetching request and headers; Mar 13 17:43:24 fal zorp/in2out_http[10007]: http.request(6): (svc/in_out_http:9/http): Request details; command='GET', url='/', version='HTTP/1.1' Mar 13 17:43:24 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:9/http): processing request and headers; Mar 13 17:43:24 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:9/http): Filtering request and headers; Mar 13 17:43:24 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:9/http): Attribute changed; attribute='request_url', newvalue=''http://www.balabit.hu/'' Mar 13 17:43:24 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:9/http): Reprocessing filtered request; Mar 13 17:43:24 fal zorp/in2out_http[10007]: http.accounting(4): (svc/in_out_http:9/http): Accounting; command='GET', url='http://www.balabit.hu/' Mar 13 17:43:24 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:9/http): Sending request and headers, copying request data; Mar 13 17:43:24 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:9/http): Attribute fetched; attribute='server_local_tos', value='0' Mar 13 17:43:24 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:9/http): Established connection; protocol='1', remote='AF_INET(217.20.130.97:80)', local='AF_INET(193.6.29.253:54202)', dest='AF_INET(217.20.130.97:80)' Mar 13 17:43:24 fal zorp/in2out_http[10007]: core.session(3): (svc/in_out_http:9/http): Server connection established; server_fd='23', server_address='AF_INET(217.20.130.97:80)', server_zone='Zone(out, 0.0.0.0/0)', server_local='AF_INET(193.6.29.253:54202)', server_protocol='TCP' Mar 13 17:43:24 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:9/http): Attribute fetched; attribute='request_method', value=''GET'' Mar 13 17:43:24 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:9/http): Stacked proxy accepted data; Mar 13 17:43:24 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:9/http): Fetching response and headers; Mar 13 17:43:24 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:9/http): Processing response and headers; Mar 13 17:43:24 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:9/http): Filtering response and headers; Mar 13 17:43:24 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:9/http): Copying response and headers, copying response data; Mar 13 17:43:24 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:9/http): Attribute fetched; attribute='request_method', value=''GET'' Mar 13 17:43:24 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:9/http): Stacked proxy accepted data; Mar 13 17:43:24 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:9/http): Fetching request and headers; Mar 13 17:43:24 fal zorp/in2out_http[10007]: http.request(6): (svc/in_out_http:9/http): Request details; command='GET', url='/favicon.ico', version='HTTP/1.1' Mar 13 17:43:24 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:9/http): processing request and headers; Mar 13 17:43:24 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:9/http): Filtering request and headers; Mar 13 17:43:24 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:9/http): Attribute changed; attribute='request_url', newvalue=''http://www.balabit.hu/'' Mar 13 17:43:24 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:9/http): Reprocessing filtered request; Mar 13 17:43:24 fal zorp/in2out_http[10007]: http.accounting(4): (svc/in_out_http:9/http): Accounting; command='GET', url='http://www.balabit.hu/' Mar 13 17:43:24 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:9/http): Sending request and headers, copying request data; Mar 13 17:43:24 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:9/http): Attribute fetched; attribute='request_method', value=''GET'' Mar 13 17:43:24 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:9/http): Stacked proxy accepted data; Mar 13 17:43:24 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:9/http): Fetching response and headers; Mar 13 17:43:24 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:9/http): Processing response and headers; Mar 13 17:43:24 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:9/http): Filtering response and headers; Mar 13 17:43:24 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:9/http): Copying response and headers, copying response data; Mar 13 17:43:24 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:9/http): Attribute fetched; attribute='request_method', value=''GET'' Mar 13 17:43:24 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:9/http): Stacked proxy accepted data; Mar 13 17:43:24 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:9/http): Fetching request and headers; (latrhato, hogy a 217.20.130.97 iphez kapcsolodik) ------------------------------------------------ 6-os loglevelen cliens http://www.mta.hu-t keri: Mar 13 17:49:03 fal rsyslogd-2177: imuxsock lost 530 messages from pid 10007 due to rate-limiting Mar 13 17:49:03 fal zorp/in2out_http[10007]: core.debug(6): (dsp/dispatch:0): Incoming connection; protocol='1', remote='AF_INET(172.16.7.61:39781)', local='AF_INET(195.111.1.69:80)', dest='AF_INET(195.111.1.69:80)' Mar 13 17:49:03 fal zorp/in2out_http[10007]: core.session(5): (svc/in_out_http): Starting service; name='in_out_http' Mar 13 17:49:03 fal zorp/in2out_http[10007]: core.session(3): (svc/in_out_http:79): Starting proxy instance; client_fd='19', client_address='AF_INET(172.16.7.61:39781)', client_zone='Zone(in, 172.16.0.0/16)', client_local='AF_INET(195.111.1.69:80)', client_protocol='TCP' Mar 13 17:49:03 fal zorp/in2out_http[10007]: core.session(5): (svc/in_out_http:79/http): Proxy starting; class='MyHttpProxy', proxy='http' Mar 13 17:49:03 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:79/http): thread starting; Mar 13 17:49:03 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:79/http): Attribute changed; attribute='language', newvalue=''en'' Mar 13 17:49:03 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:79/http): Attribute fetched; attribute='ssl', value='ZPolicyStruct object type Shared' Mar 13 17:49:03 zorp/in2out_http[10007]: last message repeated 7 times Mar 13 17:49:03 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:79/http): Attribute fetched; attribute='request', value='<Zorp hash object at 0x7f216a486ad0>' Mar 13 17:49:03 zorp/in2out_http[10007]: last message repeated 3 times Mar 13 17:49:03 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:79/http): Attribute fetched; attribute='ssl', value='ZPolicyStruct object type Shared' Mar 13 17:49:03 zorp/in2out_http[10007]: last message repeated 2 times Mar 13 17:49:03 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:79/http): Fetching request and headers; Mar 13 17:49:03 fal zorp/in2out_http[10007]: http.request(6): (svc/in_out_http:79/http): Request details; command='GET', url='/', version='HTTP/1.1' Mar 13 17:49:03 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:79/http): processing request and headers; Mar 13 17:49:03 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:79/http): Filtering request and headers; Mar 13 17:49:03 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:79/http): Attribute changed; attribute='request_url', newvalue=''http://www.balabit.hu/'' Mar 13 17:49:03 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:79/http): Reprocessing filtered request; Mar 13 17:49:03 fal zorp/in2out_http[10007]: http.accounting(4): (svc/in_out_http:79/http): Accounting; command='GET', url='http://www.balabit.hu/' Mar 13 17:49:03 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:79/http): Sending request and headers, copying request data; Mar 13 17:49:03 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:79/http): Attribute fetched; attribute='server_local_tos', value='0' Mar 13 17:49:03 fal zorp/in2out_http[10007]: core.debug(6): (dsp/dispatch:0): Incoming connection; protocol='1', remote='AF_INET(172.16.7.61:39782)', local='AF_INET(195.111.1.69:80)', dest='AF_INET(195.111.1.69:80)' Mar 13 17:49:03 fal zorp/in2out_http[10007]: core.session(5): (svc/in_out_http): Starting service; name='in_out_http' Mar 13 17:49:03 fal zorp/in2out_http[10007]: core.session(3): (svc/in_out_http:80): Starting proxy instance; client_fd='22', client_address='AF_INET(172.16.7.61:39782)', client_zone='Zone(in, 172.16.0.0/16)', client_local='AF_INET(195.111.1.69:80)', client_protocol='TCP' Mar 13 17:49:03 fal zorp/in2out_http[10007]: core.session(5): (svc/in_out_http:80/http): Proxy starting; class='MyHttpProxy', proxy='http' Mar 13 17:49:03 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:80/http): thread starting; Mar 13 17:49:03 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:80/http): Attribute changed; attribute='language', newvalue=''en'' Mar 13 17:49:03 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:80/http): Attribute fetched; attribute='ssl', value='ZPolicyStruct object type Shared' Mar 13 17:49:03 zorp/in2out_http[10007]: last message repeated 7 times Mar 13 17:49:03 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:80/http): Attribute fetched; attribute='request', value='<Zorp hash object at 0x7f216a486968>' Mar 13 17:49:03 zorp/in2out_http[10007]: last message repeated 3 times Mar 13 17:49:03 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:80/http): Attribute fetched; attribute='ssl', value='ZPolicyStruct object type Shared' Mar 13 17:49:03 zorp/in2out_http[10007]: last message repeated 2 times Mar 13 17:49:03 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:80/http): Fetching request and headers; Mar 13 17:49:03 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:79/http): Established connection; protocol='1', remote='AF_INET(195.111.1.69:80)', local='AF_INET(193.6.29.253:36376)', dest='AF_INET(195.111.1.69:80)' Mar 13 17:49:03 fal zorp/in2out_http[10007]: core.session(3): (svc/in_out_http:79/http): Server connection established; server_fd='21', server_address='AF_INET(195.111.1.69:80)', server_zone='Zone(out, 0.0.0.0/0)', server_local='AF_INET(193.6.29.253:36376)', server_protocol='TCP' Mar 13 17:49:03 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:79/http): Attribute fetched; attribute='request_method', value=''GET'' Mar 13 17:49:03 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:79/http): Stacked proxy accepted data; Mar 13 17:49:03 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:79/http): Fetching response and headers; Mar 13 17:49:03 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:79/http): Processing response and headers; Mar 13 17:49:03 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:79/http): Filtering response and headers; Mar 13 17:49:03 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:79/http): Copying response and headers, copying response data; Mar 13 17:49:03 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:79/http): Attribute fetched; attribute='request_method', value=''GET'' Mar 13 17:49:03 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:79/http): Stacked proxy accepted data; Mar 13 17:49:03 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:79/http): Fetching request and headers; Mar 13 17:49:03 fal zorp/in2out_http[10007]: core.debug(6): (dsp/dispatch:0): Incoming connection; protocol='1', remote='AF_INET(172.16.7.61:33196)', local='AF_INET(85.236.55.39:80)', dest='AF_INET(85.236.55.39:80)' Mar 13 17:49:03 fal zorp/in2out_http[10007]: core.session(5): (svc/in_out_http): Starting service; name='in_out_http' Mar 13 17:49:03 fal zorp/in2out_http[10007]: core.session(3): (svc/in_out_http:81): Starting proxy instance; client_fd='24', client_address='AF_INET(172.16.7.61:33196)', client_zone='Zone(in, 172.16.0.0/16)', client_local='AF_INET(85.236.55.39:80)', client_protocol='TCP' Mar 13 17:49:03 fal zorp/in2out_http[10007]: core.session(5): (svc/in_out_http:81/http): Proxy starting; class='MyHttpProxy', proxy='http' Mar 13 17:49:03 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:81/http): thread starting; Mar 13 17:49:03 fal zorp/in2out_http[10007]: core.debug(6): (dsp/dispatch:0): Incoming connection; protocol='1', remote='AF_INET(172.16.7.61:33197)', local='AF_INET(85.236.55.39:80)', dest='AF_INET(85.236.55.39:80)' Mar 13 17:49:03 fal zorp/in2out_http[10007]: core.session(5): (svc/in_out_http): Starting service; name='in_out_http' Mar 13 17:49:03 fal zorp/in2out_http[10007]: core.session(3): (svc/in_out_http:82): Starting proxy instance; client_fd='25', client_address='AF_INET(172.16.7.61:33197)', client_zone='Zone(in, 172.16.0.0/16)', client_local='AF_INET(85.236.55.39:80)', client_protocol='TCP' Mar 13 17:49:03 fal zorp/in2out_http[10007]: core.session(5): (svc/in_out_http:82/http): Proxy starting; class='MyHttpProxy', proxy='http' Mar 13 17:49:03 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:81/http): Attribute changed; attribute='language', newvalue=''en'' Mar 13 17:49:03 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:81/http): Attribute fetched; attribute='ssl', value='ZPolicyStruct object type Shared' Mar 13 17:49:03 zorp/in2out_http[10007]: last message repeated 7 times Mar 13 17:49:03 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:81/http): Attribute fetched; attribute='request', value='<Zorp hash object at 0x7f216a486aa8>' Mar 13 17:49:03 zorp/in2out_http[10007]: last message repeated 3 times Mar 13 17:49:03 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:81/http): Attribute fetched; attribute='ssl', value='ZPolicyStruct object type Shared' Mar 13 17:49:03 zorp/in2out_http[10007]: last message repeated 2 times Mar 13 17:49:03 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:81/http): Fetching request and headers; Mar 13 17:49:03 fal zorp/in2out_http[10007]: http.request(6): (svc/in_out_http:81/http): Request details; command='GET', url='/', version='HTTP/1.1' Mar 13 17:49:03 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:81/http): processing request and headers; Mar 13 17:49:03 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:81/http): Filtering request and headers; Mar 13 17:49:03 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:82/http): thread starting; Mar 13 17:49:03 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:81/http): Attribute changed; attribute='request_url', newvalue=''http://www.balabit.hu/'' Mar 13 17:49:03 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:81/http): Reprocessing filtered request; Mar 13 17:49:03 fal zorp/in2out_http[10007]: http.accounting(4): (svc/in_out_http:81/http): Accounting; command='GET', url='http://www.balabit.hu/' Mar 13 17:49:03 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:81/http): Sending request and headers, copying request data; Mar 13 17:49:03 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:82/http): Attribute changed; attribute='language', newvalue=''en'' Mar 13 17:49:03 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:82/http): Attribute fetched; attribute='ssl', value='ZPolicyStruct object type Shared' Mar 13 17:49:03 zorp/in2out_http[10007]: last message repeated 7 times Mar 13 17:49:03 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:82/http): Attribute fetched; attribute='request', value='<Zorp hash object at 0x7f216a486fa8>' Mar 13 17:49:03 zorp/in2out_http[10007]: last message repeated 3 times Mar 13 17:49:03 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:82/http): Attribute fetched; attribute='ssl', value='ZPolicyStruct object type Shared' Mar 13 17:49:03 zorp/in2out_http[10007]: last message repeated 2 times Mar 13 17:49:03 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:81/http): Attribute fetched; attribute='server_local_tos', value='0' Mar 13 17:49:03 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:82/http): Fetching request and headers; Mar 13 17:49:03 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:81/http): Established connection; protocol='1', remote='AF_INET(85.236.55.39:80)', local='AF_INET(193.6.29.253:53942)', dest='AF_INET(85.236.55.39:80)' Mar 13 17:49:03 fal zorp/in2out_http[10007]: core.session(3): (svc/in_out_http:81/http): Server connection established; server_fd='28', server_address='AF_INET(85.236.55.39:80)', server_zone='Zone(out, 0.0.0.0/0)', server_local='AF_INET(193.6.29.253:53942)', server_protocol='TCP' Mar 13 17:49:03 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:81/http): Attribute fetched; attribute='request_method', value=''GET'' Mar 13 17:49:03 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:81/http): Stacked proxy accepted data; Mar 13 17:49:03 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:81/http): Fetching response and headers; Mar 13 17:49:03 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:81/http): Processing response and headers; Mar 13 17:49:03 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:81/http): Filtering response and headers; Mar 13 17:49:03 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:81/http): Copying response and headers, copying response data; Mar 13 17:49:03 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:81/http): Attribute fetched; attribute='request_method', value=''GET'' Mar 13 17:49:03 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:81/http): Stacked proxy accepted data; Mar 13 17:49:03 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:81/http): Fetching request and headers; Mar 13 17:49:04 fal zorp/in2out_http[10007]: core.debug(6): (dsp/dispatch:0): Incoming connection; protocol='1', remote='AF_INET(172.16.7.61:33198)', local='AF_INET(85.236.55.39:80)', dest='AF_INET(85.236.55.39:80)' Mar 13 17:49:04 fal zorp/in2out_http[10007]: core.session(5): (svc/in_out_http): Starting service; name='in_out_http' Mar 13 17:49:04 fal zorp/in2out_http[10007]: core.session(3): (svc/in_out_http:83): Starting proxy instance; client_fd='29', client_address='AF_INET(172.16.7.61:33198)', client_zone='Zone(in, 172.16.0.0/16)', client_local='AF_INET(85.236.55.39:80)', client_protocol='TCP' Mar 13 17:49:04 fal zorp/in2out_http[10007]: core.session(5): (svc/in_out_http:83/http): Proxy starting; class='MyHttpProxy', proxy='http' Mar 13 17:49:04 fal zorp/in2out_http[10007]: core.debug(6): (dsp/dispatch:0): Incoming connection; protocol='1', remote='AF_INET(172.16.7.61:33199)', local='AF_INET(85.236.55.39:80)', dest='AF_INET(85.236.55.39:80)' Mar 13 17:49:04 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:83/http): thread starting; Mar 13 17:49:04 fal zorp/in2out_http[10007]: core.session(5): (svc/in_out_http): Starting service; name='in_out_http' Mar 13 17:49:04 fal zorp/in2out_http[10007]: core.session(3): (svc/in_out_http:84): Starting proxy instance; client_fd='30', client_address='AF_INET(172.16.7.61:33199)', client_zone='Zone(in, 172.16.0.0/16)', client_local='AF_INET(85.236.55.39:80)', client_protocol='TCP' Mar 13 17:49:04 fal zorp/in2out_http[10007]: core.session(5): (svc/in_out_http:84/http): Proxy starting; class='MyHttpProxy', proxy='http' Mar 13 17:49:04 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:84/http): thread starting; Mar 13 17:49:04 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:83/http): Attribute changed; attribute='language', newvalue=''en'' Mar 13 17:49:04 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:83/http): Attribute fetched; attribute='ssl', value='ZPolicyStruct object type Shared' Mar 13 17:49:04 zorp/in2out_http[10007]: last message repeated 7 times Mar 13 17:49:04 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:83/http): Attribute fetched; attribute='request', value='<Zorp hash object at 0x7f216a486f58>' Mar 13 17:49:04 zorp/in2out_http[10007]: last message repeated 3 times Mar 13 17:49:04 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:83/http): Attribute fetched; attribute='ssl', value='ZPolicyStruct object type Shared' Mar 13 17:49:04 zorp/in2out_http[10007]: last message repeated 2 times Mar 13 17:49:04 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:84/http): Attribute changed; attribute='language', newvalue=''en'' Mar 13 17:49:04 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:84/http): Attribute fetched; attribute='ssl', value='ZPolicyStruct object type Shared' Mar 13 17:49:04 zorp/in2out_http[10007]: last message repeated 7 times Mar 13 17:49:04 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:84/http): Attribute fetched; attribute='request', value='<Zorp hash object at 0x7f216a411490>' Mar 13 17:49:04 zorp/in2out_http[10007]: last message repeated 3 times Mar 13 17:49:04 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:84/http): Attribute fetched; attribute='ssl', value='ZPolicyStruct object type Shared' Mar 13 17:49:04 zorp/in2out_http[10007]: last message repeated 2 times Mar 13 17:49:04 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:83/http): Fetching request and headers; Mar 13 17:49:04 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:84/http): Fetching request and headers; Mar 13 17:49:04 fal zorp/in2out_http[10007]: http.request(6): (svc/in_out_http:83/http): Request details; command='GET', url='/hu/', version='HTTP/1.1' Mar 13 17:49:04 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:83/http): processing request and headers; Mar 13 17:49:04 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:83/http): Filtering request and headers; Mar 13 17:49:04 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:83/http): Attribute changed; attribute='request_url', newvalue=''http://www.balabit.hu/'' Mar 13 17:49:04 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:83/http): Reprocessing filtered request; Mar 13 17:49:04 fal zorp/in2out_http[10007]: http.accounting(4): (svc/in_out_http:83/http): Accounting; command='GET', url='http://www.balabit.hu/' Mar 13 17:49:04 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:83/http): Sending request and headers, copying request data; Mar 13 17:49:04 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:83/http): Attribute fetched; attribute='server_local_tos', value='0' Mar 13 17:49:04 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:83/http): Established connection; protocol='1', remote='AF_INET(85.236.55.39:80)', local='AF_INET(193.6.29.253:53943)', dest='AF_INET(85.236.55.39:80)' Mar 13 17:49:04 fal zorp/in2out_http[10007]: core.session(3): (svc/in_out_http:83/http): Server connection established; server_fd='33', server_address='AF_INET(85.236.55.39:80)', server_zone='Zone(out, 0.0.0.0/0)', server_local='AF_INET(193.6.29.253:53943)', server_protocol='TCP' Mar 13 17:49:04 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:83/http): Attribute fetched; attribute='request_method', value=''GET'' Mar 13 17:49:04 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:83/http): Stacked proxy accepted data; Mar 13 17:49:04 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:83/http): Fetching response and headers; Mar 13 17:49:04 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:83/http): Processing response and headers; Mar 13 17:49:04 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:83/http): Filtering response and headers; Mar 13 17:49:04 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:83/http): Copying response and headers, copying response data; Mar 13 17:49:04 fal zorp/in2out_http[10007]: core.debug(6): (svc/in_out_http:83/http): Attribute fetched; attribute='request_method', value=''GET'' Mar 13 17:49:04 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:83/http): Stacked proxy accepted data; Mar 13 17:49:04 fal zorp/in2out_http[10007]: http.debug(6): (svc/in_out_http:83/http): Fetching request and headers; (www.mta.hu utan a www.balabit.hu-t is lekeri. Azt sem ertem, miert kell a www.mta.hu oldalt lekernie??)
2012-03-13 17:54 keltezéssel, tusi írta:
Sziasztok,
probalom a zorp 3.9.2-t mukodesre birni. Alapjaban mar majdnem minden megy, csak az url redirect nem. Az alabbi konfig file-ok eseten, bizonyos oldalakra valoban a www.balabit.hu jon be (pl www.mta.hu), viszont szamos esetben az eredeti oldal (pl index.hu) hibajelzessel (a kert oldal nem talalhato). Mi lehet a hiba? Az a baj, hogy attól, hogy a HTTP fejlécben átírod a request_url-t még nem fog a proxy másik szerverhez csatlakozni. A proxy indulásakor amit a kliens címez, az lesz a tényleges cél is. vagyis az index.hu szervernek fogja elküldeni a GET http://www.balabit.hu request-et. Lehet, hogy elhajt a szerver, vagy ha rosszul van beállítva akár még ki is szolgál. De szerintem te nem ezt akarod.
Ha policy-ben meg szeretnéd változtatni, a célszervert, akkor TransparentRouter() helyett InbandRouter()-t kell használnod, vagy küldhetsz vissza '301 moved permanently'-t. Fordítsuk meg a dolgot. Inkább írd meg, hogy mi a pontos cél, mit szeretnél a proxyval elérni, és segítünk. i.
Koszonom a valaszt. Azt szeretnem elerni, hogy akarmilyen cimet ir be a bongeszobe, csak egy, altalam meghatarozott oldal jojjon be neki. Ugy mukodik, hogy szurok a cimre, es minden mas cimnel REJECT-tel terek vissza, de jobb lenne, ha ezekben az esetekben is az altalam megadott cim jojjon be. Meg tavolabrol azt szeretnem, hogy amig a belso halon nem regisztraltak egy gepet mac cim alapjan, addig ne todjon a tuzfalon kimenni, hanem a tuzfal kuldje a regisztracios oldalra. Probalkoztam a 301 moved permanently megoldassal is a balabit oldalan levo http->https atiranyitas pelda alapjan, de az sem mukodott. Koszonom a valaszokat, es ahelyes iranyba terelest, tusi On Wed, 2012-03-14 at 10:03 +0100, Lázár Imre wrote:
2012-03-13 17:54 keltezéssel, tusi írta:
Sziasztok,
probalom a zorp 3.9.2-t mukodesre birni. Alapjaban mar majdnem minden megy, csak az url redirect nem. Az alabbi konfig file-ok eseten, bizonyos oldalakra valoban a www.balabit.hu jon be (pl www.mta.hu), viszont szamos esetben az eredeti oldal (pl index.hu) hibajelzessel (a kert oldal nem talalhato). Mi lehet a hiba? Az a baj, hogy attól, hogy a HTTP fejlécben átírod a request_url-t még nem fog a proxy másik szerverhez csatlakozni. A proxy indulásakor amit a kliens címez, az lesz a tényleges cél is. vagyis az index.hu szervernek fogja elküldeni a GET http://www.balabit.hu request-et. Lehet, hogy elhajt a szerver, vagy ha rosszul van beállítva akár még ki is szolgál. De szerintem te nem ezt akarod.
Ha policy-ben meg szeretnéd változtatni, a célszervert, akkor TransparentRouter() helyett InbandRouter()-t kell használnod, vagy küldhetsz vissza '301 moved permanently'-t. Fordítsuk meg a dolgot. Inkább írd meg, hogy mi a pontos cél, mit szeretnél a proxyval elérni, és segítünk.
i.
_______________________________________________ zorp-hu mailing list zorp-hu@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/zorp-hu
Szia, On 03/14/2012 10:34 AM, tusi wrote:
Koszonom a valaszt. Azt szeretnem elerni, hogy akarmilyen cimet ir be a bongeszobe, csak egy, altalam meghatarozott oldal jojjon be neki. Ugy mukodik, hogy szurok a cimre, es minden mas cimnel REJECT-tel terek vissza, de jobb lenne, ha ezekben az esetekben is az altalam megadott cim jojjon be. Meg tavolabrol azt szeretnem, hogy amig a belso halon nem regisztraltak egy gepet mac cim alapjan, addig ne todjon a tuzfalon kimenni, hanem a tuzfal kuldje a regisztracios oldalra. Probalkoztam a 301 moved permanently megoldassal is a balabit oldalan levo http->https atiranyitas pelda alapjan, de az sem mukodott.
Koszonom a valaszokat, es ahelyes iranyba terelest, tusi
Ha feltétel alapján szeretnéd csinálni, akkor InbandRouter mellett (vagy overrideable TransparentRouter mellett) a proxy setServerAddress metódusában a feltétel alapján vagy kicseréled a célhostot, vagy nem. Pl teszteletlenül így: def setServerAddress(self, host, port): if self.session.client_zone != "intranet.mehetanetre" host = "registerserver.intranet.local" proxyLog(self, CORE_POLICY, 3, "Client zone is not allowed to connect directly, redirecting; host='%s', port='%d'", (host, port)) return HttpProxy.setServerAddress(self, host, port) Balint
Koszonom. Ez mar majdnem mukodik. Ket bajom van vele: -hogyan tudok url-t megadni? -hogyan mukodik ez egyutt a NameVirtual hosttal? Ezt probaltam: def setServerAddress(self, host, port): host = "www.myhost.hu" self.request_url = 'http://www.myhost.hu/mac_register.html' proxyLog(self, CORE_POLICY, 3, "Client zone is not allowed to connect directly, redirecting; host='%s', port='%d'", (host, port)) return HttpProxy.setServerAddress(self, host, port) Ebben az esetben kapcsolodik a www.myhost.hu-hoz, ami egy virtual host, de a nev nem kerul at a web szerverhez, ezert nem tudja kiszolgalni (404-es hibat ad). Koszonom a segitseget, tusi On Wed, 2012-03-14 at 11:06 +0100, Kovács Bálint wrote:
Szia,
On 03/14/2012 10:34 AM, tusi wrote:
Koszonom a valaszt. Azt szeretnem elerni, hogy akarmilyen cimet ir be a bongeszobe, csak egy, altalam meghatarozott oldal jojjon be neki. Ugy mukodik, hogy szurok a cimre, es minden mas cimnel REJECT-tel terek vissza, de jobb lenne, ha ezekben az esetekben is az altalam megadott cim jojjon be. Meg tavolabrol azt szeretnem, hogy amig a belso halon nem regisztraltak egy gepet mac cim alapjan, addig ne todjon a tuzfalon kimenni, hanem a tuzfal kuldje a regisztracios oldalra. Probalkoztam a 301 moved permanently megoldassal is a balabit oldalan levo http->https atiranyitas pelda alapjan, de az sem mukodott.
Koszonom a valaszokat, es ahelyes iranyba terelest, tusi
Ha feltétel alapján szeretnéd csinálni, akkor InbandRouter mellett (vagy overrideable TransparentRouter mellett) a proxy setServerAddress metódusában a feltétel alapján vagy kicseréled a célhostot, vagy nem. Pl teszteletlenül így:
def setServerAddress(self, host, port): if self.session.client_zone != "intranet.mehetanetre" host = "registerserver.intranet.local" proxyLog(self, CORE_POLICY, 3, "Client zone is not allowed to connect directly, redirecting; host='%s', port='%d'", (host, port)) return HttpProxy.setServerAddress(self, host, port)
Balint
_______________________________________________ zorp-hu mailing list zorp-hu@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/zorp-hu
Szia, On 03/14/2012 11:50 AM, tusi wrote:
Koszonom. Ez mar majdnem mukodik. Ket bajom van vele: -hogyan tudok url-t megadni? -hogyan mukodik ez egyutt a NameVirtual hosttal?
Ezt probaltam:
def setServerAddress(self, host, port): host = "www.myhost.hu" self.request_url = 'http://www.myhost.hu/mac_register.html' proxyLog(self, CORE_POLICY, 3, "Client zone is not allowed to connect directly, redirecting; host='%s', port='%d'", (host, port)) return HttpProxy.setServerAddress(self, host, port)
Ebben az esetben kapcsolodik a www.myhost.hu-hoz, ami egy virtual host, de a nev nem kerul at a web szerverhez, ezert nem tudja kiszolgalni (404-es hibat ad).
Koszonom a segitseget, tusi Nem vagyok biztos benne, hogy innen eléred a request_url-t. Tcpdump alapján milyen host header-t ad át a szervernek? Esetleg megpróbálhatod a request_url változó teljes elérési útjával (azt hiszem self.session.proxy.request_url) de szerintem nem itt lesz a gond, az eredeti megoldásoddal kéne kombinálni, valahogy így:
class MyHttpProxy(HttpProxy): def config(self): HttpProxy.config(self) self.request["GET"] = (HTTP_REQ_POLICY, self.filterURL) def filterURL(self, method, url, version): self.request_url = 'http://www.myhost.hu/mac_register.html' return HTTP_REQ_ACCEPT def setServerAddress(self, host, port): host = "www.myhost.hu" proxyLog(self, CORE_POLICY, 3, "Client zone is not allowed to connect directly, redirecting; host='%s', port='%d'", (host, port)) return HttpProxy.setServerAddress(self, host, port) Balint
On Wed, Mar 14, 2012 at 11:50:54AM +0100, tusi wrote:
Ezt probaltam:
def setServerAddress(self, host, port): host = "www.myhost.hu" self.request_url = 'http://www.myhost.hu/mac_register.html' proxyLog(self, CORE_POLICY, 3, "Client zone is not allowed to connect directly, redirecting; host='%s', port='%d'", (host, port)) return HttpProxy.setServerAddress(self, host, port)
Ebben az esetben kapcsolodik a www.myhost.hu-hoz, ami egy virtual host, de a nev nem kerul at a web szerverhez, ezert nem tudja kiszolgalni (404-es hibat ad).
Egy error_info = "Nem regisztralt mac address, menj ide: http://www.myhost.hu/mac_register.html" nem lehet megoldas? Nem tudom, hogy az error_info-hoz nem lehet-e egy html fajlt megadni, es abban mar konnyu megoldani az atiranyitast (ami a bongeszot iranyitja at, nem kell a tuzfalnak semmit sem csinalnia). -- Udvozlettel Zsiga
On Wed, Mar 14, 2012 at 10:34:50AM +0100, tusi wrote:
Koszonom a valaszt. Azt szeretnem elerni, hogy akarmilyen cimet ir be a bongeszobe, csak egy, altalam meghatarozott oldal jojjon be neki. Ugy mukodik, hogy szurok a cimre, es minden mas cimnel REJECT-tel terek vissza, de jobb lenne, ha ezekben az esetekben is az altalam megadott cim jojjon be. Meg tavolabrol azt szeretnem, hogy amig a belso halon nem regisztraltak egy gepet mac cim alapjan, addig ne todjon a tuzfalon kimenni, hanem a tuzfal kuldje a regisztracios oldalra.
Es a tuzfal honnan fogja tudni, hogy regisztralt-e az a mac address, ami eppen jon? Csak azert kerdezem, mert az elkuldott konfigodban csak egy IP tartomany szerepelt, amibol barki felvehet kezzel egy cimet. Arra nem erdemes a biztonsagot alapozni, hogy akinek a dhcp szerver nem ad cimet, az nem tud netezni. -- Udvozlettel Zsiga
Es a tuzfal honnan fogja tudni, hogy regisztralt-e az a mac address, ami eppen jon? Csak azert kerdezem, mert az elkuldott konfigodban csak egy IP tartomany szerepelt, amibol barki felvehet kezzel egy cimet. Arra nem erdemes a biztonsagot alapozni, hogy akinek a dhcp szerver nem ad cimet, az nem tud netezni.
iptables-szel szurok az engedelyezett mac addressekre, azok bekerulnek a zorp normal szuresebe, a lanc vegen, pedig bekerulnek a nem engedelyezett zorp agba: PRio_checkmac - PRio - -A PREROUTING -i INTRA_IF -d INTER_NET -j PRio_checkmac -A PRio_checkmac -m mac --mac-source xx:xx:xx:xx:xx:xx -j PRio -A PRio_checkmac -m mac --mac-source xx:xx:xx:xx:xx:xx -j PRio -A PRio_checkmac -m mac --mac-source xx:xx:xx:xx:xx:xx -j PRio ... -A PRio_checkmac -p tcp --dport 80 -j TPROXY --on-port 50100 --tproxy-mark 0x1/0x1 --on-ip INTRA_IP //50100-on figyel a zorp redirect aga ... -A PRio -p tcp --dport 80 -j TPROXY --on-port 50101 --tproxy-mark 0x1/0x1 --on-ip INTRA_IP //zorp normal ag A mac addresseket sql-ben tarolom, es valtozas eseten ujrageneralom az iptables.conf-ot. Mindez egyenlore meg csak terv, de ha tudsz jobb megoldast, orommel veszem. Udv tusi
On Wed, Mar 14, 2012 at 12:02:03PM +0100, tusi wrote:
Es a tuzfal honnan fogja tudni, hogy regisztralt-e az a mac address, ami eppen jon? Csak azert kerdezem, mert az elkuldott konfigodban csak egy IP tartomany szerepelt, amibol barki felvehet kezzel egy cimet. Arra nem erdemes a biztonsagot alapozni, hogy akinek a dhcp szerver nem ad cimet, az nem tud netezni.
iptables-szel szurok az engedelyezett mac addressekre, azok bekerulnek a
A modern operacios rendszerekben a megfelelo jogosultsaggal rendelkezo felhasznalo at tudja irni a mac address-t. Emiatt nem biztos, hogy megeri az erofeszitest. Inkabb egy usernev/jelszo alapu proxy-t javasolnek, es csak az mehet ki a tuzfalon, senki mas. Az arpwatch pedig tajekoztat a mac address es/vagy IP cim cserelgetos probalkozasokrol. -- Udvozlettel Zsiga
Hi All! 2012. 03. 14, szerda keltezéssel 12.02-kor tusi ezt írta:
iptables-szel szurok az engedelyezett mac addressekre, azok bekerulnek a zorp normal szuresebe, a lanc vegen, pedig bekerulnek a nem engedelyezett zorp agba:
Ebben az esetben viszont nem egyszerűbb DirectedRouter-t használni? Ugyanis azok a kérések, amik ehhez a service-hez jutnak el, ott már nem kell dönteni, azok megkapják az authentikáld maga kérést. Vagy valamit félreértek? -- Attila Szalay Product Security Specialist e-mail: attila.szalay@balabit.com phone: +36 1 398 6707 BalaBit IT Security www.balabit.com H-1117 Budapest, Aliz street 2. This Communication is Confidential. We only send and receive email on the basis of the term set out at http://www.balabit.com/disclaimer/.
participants (5)
-
Kosa Attila
-
Kovács Bálint
-
Lázár Imre
-
Szalay Attila
-
tusi