October 2004 - zorp - lists.balabit.hu

Virtual IP PlugProxy
by Phil Moors 28 Oct '04

28 Oct '04

What is the right way to use a virtual ip address (alias) bound to an outside interface and forward traffic to a host in the private network? I can get the Plug to work with the eth3 address, but not with the eth3:1 address. I tried setting up an InetZone with the ip address bound to eth3:1, but the packets disappear after hitting the tproxy rule in the INPUT chain. I can see them move through PREROUTING and then to the PRxxx chain, but they never get back to INPUT. Or, am I going about this the wrong way? Thanks, Phil

2 1

Patch for iptables-gen (iptables-utils)
by Sheldon Hearn 27 Oct '04

27 Oct '04

The iptables-utils package is a fantastic piece of software. It allows me to manage remote firewalls with confidence. Recently, I had to set up a firewall for an ADSL-connected site, where they use the MASQUERADE target. They also want a few ports forwarded to specific hosts on the internal network. I want my ppp linkup script (/etc/ppp/ip-up in Gentoo Linux) to generate iptables.conf.var, adding a line like this: #define MY_ADDR 196.31.31.10 Then I want iptables-gen to regenerate the ruleset, given rules like this in iptables.conf.in: -A PREROUTING -p tcp \ -d MY_ADDR --dport 2222 -j DNAT --to-destination 10.0.0.2:22 -A POSTROUTING -p tcp \ -s 10.0.0.2 --sport 22 -j SNAT --to-source MY_ADDR:2222 However, the current implementation of iptables-gen (in iptables-utils-1.20) only substitutes defined variables that are immediately followed by whitespace of end of line. It doesn't substitute defined variables that are immediately followed by a colon (:). Therefore, I propose the attached patch to iptables-gen.in, which includes the colon (:) as a legal delimiter for defined variables. Ciao, Sheldon.

2 1

Python and Policy
by Phil Moors 24 Oct '04

24 Oct '04

I'm seeing 'import site failed' messages in the log when using zorpctl to start an instance. I only have one version of python installed (2.2.3). The zorp python lib seem to be found okay and the instance does start. Oct 22 15:09:10 fw1 intra[6791]: (noname/nosession): Starting up; verbose_level='100', version='2.1.8' Oct 22 15:09:10 fw1 intra[6793]: (Log thread): thread starting; Oct 22 15:09:10 fw1 intra[6791]: (noname/nosession): System dependant init; sysdep_tproxy='1' Oct 22 15:09:10 fw1 intra[6791]: (noname/nosession): Start to listen; fd='11' Oct 22 15:09:10 fw1 intra[6796]: (conntrack/thread): thread starting; Oct 22 15:09:10 fw1 intra[6791]: zorp version 2.1.8 starting up Oct 22 15:09:10 fw1 intra[6793]: (Log thread): 'import site' failed; use -v for traceback Oct 22 15:09:10 fw1 intra[6793]: (Log thread): 'import site' failed; use -v for traceback Oct 22 15:09:10 fw1 intra[6791]: (noname/nosession): Zone(intra): outbound service=intra_HTTP Oct 22 15:09:10 fw1 intra[6791]: (noname/nosession): Zone(dmz): inbound service=intra_HTTP Oct 22 15:09:10 fw1 intra[6791]: (noname/nosession): Zone(inter): inbound service=intra_HTTP Oct 22 15:09:10 fw1 intra[6791]: (intra@zorp): Dispatcher on address; proto='1', local='AF_INET(192.168.115.45:50080)', prio='100' Oct 22 15:09:10 fw1 intra[6791]: (intra@zorp/nosession): Start to listen; fd='14' When I send an http request out, I get the, 'There was a problem connecting to the host you specified' message returned. This is a very simple policy (further below). The log reports, 'Inbound service not permitted'. When setting an outbound policy, is the return connection automatically allowed? Oct 22 15:29:38 fw2 priv[8970]: (priv@zorp/intra_HTTP:0): Starting proxy instance; client_fd='15', client_address='AF_INET(192.168.115.49:36435)', client_zone='Zone(priv, 192.168.0.0/16)', client_local='AF_INET(192.168.115.9:50080)' Oct 22 15:29:38 fw2 priv[9002]: (priv@zorp/intra_HTTP:0): Inbound service not permitted; service='intra_HTTP', zone='Zone(priv, 192.168.0.0/16)' Oct 22 15:29:38 fw2 priv[9002]: (priv@zorp/intra_HTTP:0/http): DAC policy violation; info='None' For fun, I added inbound_services(["*"]) to the zone and got the following repeated in the logs. Indeed, there were a lot of processes running on the system. Oct 22 15:24:26 fw2 priv[8739]: (priv@zorp/intra_HTTP:98): Starting proxy instance; client_fd='407', client_address='AF_INET(192.168.115.9:33167)', client_zone='Zone(priv, 192.168.0.0/16)', client_local='AF_INET(192.168.115.9:50080)' Oct 22 15:24:26 fw2 priv[8739]: (priv@zorp/nosession): Too many running threads, waiting for one to become free; num_threads='100', max_threads='100' Oct 22 15:24:26 fw2 priv[8869]: (priv@zorp/intra_HTTP:97/http): Server connection established; server_fd='406', server_address='AF_INET(192.168.115.9:50080)', server_zone='Zone(priv, 192.168.0.0/16)', server_local='AF_INET(192.168.115.9:33167)' Policy.py from Zorp.Core import * from Zorp.Http import * InetZone('priv', '192.168.0.0/16', outbound_services=['intra_HTTP']) InetZone('dmz', '172.17.1.0/24', inbound_services=[]) InetZone('public', '0.0.0.0/0', inbound_services=["*"]) def priv(): Service('intra_HTTP', HttpProxy) Listener(SockAddrInet('192.168.115.9', 50080), 'intra_HTTP') def dmz(): pass def public(): pass instances.conf priv -v3 -p /usr/local/etc/zorp/policy.py --autobind-ip 1.2.3.4 public -v3 -p /usr/local/etc/zorp/policy.py --autobind-ip 1.2.3.4 dmz -v3 -p /usr/local/etc/zorp/policy.py --autobind-ip 1.2.3.4 Thanks, Phil

2 1

Which GPL Kernel
by Phil Moors 21 Oct '04

21 Oct '04

Which GPL zorp should I run? I've tried 2.1.8 and I'm getting kernel panics after running an HTTP session or two through a transparent proxy. Or, maybe I should get non Redhat kernel source from kernel.org. The patch and rebuild worked without errors on the RH sources, though. Are others running 2.1.8 without problems? zorp 2.1.8 libzorpll-2.1.12.5-1 kernel 2.4.22-1.2199.nptlcustom Thanks, Phil

2 3