July 2005 - zorp - lists.balabit.hu

FYI: zorp-admin-guide 3.0.2 released
by Balazs Scheidler 22 Jul '05

22 Jul '05

Hi, A small update for those interested, we have updated Zorp Administrator's Guide, available from: http://www.balabit.com/products/docs/ Although it introduces the commercial version of Zorp, and thus focuses on the GUI based management, it contains useful insights to Zorp philosophy and thus is a recommended reading for anyone interested in Zorp. -- Bazsi

1 0

RE: [zorp] tproxy problem
by Mark Nadir 20 Jul '05

20 Jul '05

Yeah I added the x flag as well - I got the tproxy so libraries installed through trial and error. Instead of using default make command given in the instructions, i.e. "make KERNELDIR=<path-to-kernel>" I used "make KERNEL_DIR=<path-to-kernel>" This seems to have done the trick -----Original Message----- From: zorp-bounces(a)lists.balabit.hu [mailto:zorp-bounces@lists.balabit.hu] On Behalf Of Sandor Geller Sent: July 20, 2005 2:00 AM To: Zorp users mailing list Subject: RE: [zorp] tproxy problem 2005-07-20, sze keltezéssel 00.44-kor Mark Nadir ezt írta: > Hmmm - for some reason when recompiling iptables, the tproxy shared > object libraries mentioned below are NOT being compiled. > > Any thoughts on why? Did you add the executable flag to the .tproxy-test file? It has to be executable otherwise the tproxy module won't be compiled. -- Sandor Geller wildy(a)balabit.hu _______________________________________________ zorp mailing list zorp(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/zorp

1 0

RE: [zorp] tproxy problem
by Mark Nadir 20 Jul '05

20 Jul '05

Hmmm - for some reason when recompiling iptables, the tproxy shared object libraries mentioned below are NOT being compiled. Any thoughts on why? -----Original Message----- From: zorp-bounces(a)lists.balabit.hu [mailto:zorp-bounces@lists.balabit.hu] On Behalf Of Mark Nadir Sent: July 20, 2005 12:51 AM To: Zorp users mailing list Subject: RE: [zorp] tproxy problem Heh ok - recompiling/rebuilding everything from scratch again - let's see how it goes - actually, if you have 1.2.11, can you send me those so files? -----Original Message----- From: zorp-bounces(a)lists.balabit.hu [mailto:zorp-bounces@lists.balabit.hu] On Behalf Of Zhou Li Sent: July 20, 2005 12:16 AM To: Zorp users mailing list Subject: Re: [zorp] tproxy problem No, I applied it to iptables 1.2.11 successfully and it work fine. //ZhouLi ----- Original Message ----- From: "Mark Nadir" <mnadir(a)cyrca.net> To: "Zorp users mailing list" <zorp(a)lists.balabit.hu> Sent: Wednesday, July 20, 2005 11:49 Subject: RE: [zorp] tproxy problem Yah I traced that as the problem - I don't have either - which is strange since the kernel was compiled and built successfully. I am wondering if the cttproxy patch only applies to iptables 1.2.7 -----Original Message----- From: zorp-bounces(a)lists.balabit.hu [mailto:zorp-bounces@lists.balabit.hu] On Behalf Of Zhou Li Sent: July 19, 2005 11:23 PM To: Zorp users mailing list Subject: Re: [zorp] tproxy problem so you got files /lib/iptables/libipt_TPROXY.so and /lib/iptables/libipt_tproxy.so in your system? I has met the same problem when I using zorp first time, and I found reason finally was missing the two files. ----- Original Message ----- From: "Mark Nadir" <mnadir(a)cyrca.net> To: "Zorp users mailing list" <zorp(a)lists.balabit.hu> Sent: Wednesday, July 20, 2005 10:42 Subject: RE: [zorp] tproxy problem Actually zhou, I got iptables-1.2.11 and applied the patch in the source of same. -----Original Message----- From: zorp-bounces(a)lists.balabit.hu [mailto:zorp-bounces@lists.balabit.hu] On Behalf Of Zhou Li Sent: July 19, 2005 10:17 PM To: Zorp users mailing list Subject: Re: [zorp] tproxy problem I think you haven't applied iptables-1.2.7a-cttproxy-04.diff for iptables, you can find it in cttproxy-2.4.30-2.0.1.tar.gz, Mark. //ZhouLi ----- Original Message ----- From: "Mark Nadir" <mnadir(a)cyrca.net> To: "Zorp users mailing list" <zorp(a)lists.balabit.hu> Sent: Wednesday, July 20, 2005 09:37 Subject: [zorp] tproxy problem Hi there I was wondering if anyone can help me figure out why tproxy doesn't seem to work. I am currently using the 2.4.31 kernel with t-proxy patch successfully applied. However, whenever I try to create an iptables statement to enable tproxy to listen on a port, I get the following messages: iptables v1.2.11: Unknown arg `--on-port' Try `iptables -h' or 'iptables --help' for more information. An lsmod reveals the following: Module Size Used by Not tainted ipt_limit 888 6 (autoclean) ipt_state 536 28 (autoclean) iptable_tproxy 13312 0 (autoclean) (unused) ipt_LOG 3968 1 (autoclean) ipt_tproxy 504 0 (unused) iptable_filter 1740 1 (autoclean) iptable_nat 21466 1 (autoclean) [iptable_tproxy] ip_conntrack 25264 0 (autoclean) [ipt_state iptable_tproxy ipt_tproxy iptable_nat] iptable_mangle 2168 0 (autoclean) (unused) ip_tables 12128 10 [ipt_limit ipt_state iptable_tproxy ipt_LOG ipt_tproxy iptable_filter iptable_nat iptable_mangle] Anyone know why my tproxy statement returns this error of unknown argument? Thanks in advance. Regards, Mark. _______________________________________________ zorp mailing list zorp(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/zorp _______________________________________________ zorp mailing list zorp(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/zorp _______________________________________________ zorp mailing list zorp(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/zorp _______________________________________________ zorp mailing list zorp(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/zorp _______________________________________________ zorp mailing list zorp(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/zorp _______________________________________________ zorp mailing list zorp(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/zorp _______________________________________________ zorp mailing list zorp(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/zorp

3 2

RE: [zorp] tproxy problem
by Mark Nadir 20 Jul '05

20 Jul '05

Heh ok - recompiling/rebuilding everything from scratch again - let's see how it goes - actually, if you have 1.2.11, can you send me those so files? -----Original Message----- From: zorp-bounces(a)lists.balabit.hu [mailto:zorp-bounces@lists.balabit.hu] On Behalf Of Zhou Li Sent: July 20, 2005 12:16 AM To: Zorp users mailing list Subject: Re: [zorp] tproxy problem No, I applied it to iptables 1.2.11 successfully and it work fine. //ZhouLi ----- Original Message ----- From: "Mark Nadir" <mnadir(a)cyrca.net> To: "Zorp users mailing list" <zorp(a)lists.balabit.hu> Sent: Wednesday, July 20, 2005 11:49 Subject: RE: [zorp] tproxy problem Yah I traced that as the problem - I don't have either - which is strange since the kernel was compiled and built successfully. I am wondering if the cttproxy patch only applies to iptables 1.2.7 -----Original Message----- From: zorp-bounces(a)lists.balabit.hu [mailto:zorp-bounces@lists.balabit.hu] On Behalf Of Zhou Li Sent: July 19, 2005 11:23 PM To: Zorp users mailing list Subject: Re: [zorp] tproxy problem so you got files /lib/iptables/libipt_TPROXY.so and /lib/iptables/libipt_tproxy.so in your system? I has met the same problem when I using zorp first time, and I found reason finally was missing the two files. ----- Original Message ----- From: "Mark Nadir" <mnadir(a)cyrca.net> To: "Zorp users mailing list" <zorp(a)lists.balabit.hu> Sent: Wednesday, July 20, 2005 10:42 Subject: RE: [zorp] tproxy problem Actually zhou, I got iptables-1.2.11 and applied the patch in the source of same. -----Original Message----- From: zorp-bounces(a)lists.balabit.hu [mailto:zorp-bounces@lists.balabit.hu] On Behalf Of Zhou Li Sent: July 19, 2005 10:17 PM To: Zorp users mailing list Subject: Re: [zorp] tproxy problem I think you haven't applied iptables-1.2.7a-cttproxy-04.diff for iptables, you can find it in cttproxy-2.4.30-2.0.1.tar.gz, Mark. //ZhouLi ----- Original Message ----- From: "Mark Nadir" <mnadir(a)cyrca.net> To: "Zorp users mailing list" <zorp(a)lists.balabit.hu> Sent: Wednesday, July 20, 2005 09:37 Subject: [zorp] tproxy problem Hi there I was wondering if anyone can help me figure out why tproxy doesn't seem to work. I am currently using the 2.4.31 kernel with t-proxy patch successfully applied. However, whenever I try to create an iptables statement to enable tproxy to listen on a port, I get the following messages: iptables v1.2.11: Unknown arg `--on-port' Try `iptables -h' or 'iptables --help' for more information. An lsmod reveals the following: Module Size Used by Not tainted ipt_limit 888 6 (autoclean) ipt_state 536 28 (autoclean) iptable_tproxy 13312 0 (autoclean) (unused) ipt_LOG 3968 1 (autoclean) ipt_tproxy 504 0 (unused) iptable_filter 1740 1 (autoclean) iptable_nat 21466 1 (autoclean) [iptable_tproxy] ip_conntrack 25264 0 (autoclean) [ipt_state iptable_tproxy ipt_tproxy iptable_nat] iptable_mangle 2168 0 (autoclean) (unused) ip_tables 12128 10 [ipt_limit ipt_state iptable_tproxy ipt_LOG ipt_tproxy iptable_filter iptable_nat iptable_mangle] Anyone know why my tproxy statement returns this error of unknown argument? Thanks in advance. Regards, Mark. _______________________________________________ zorp mailing list zorp(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/zorp _______________________________________________ zorp mailing list zorp(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/zorp _______________________________________________ zorp mailing list zorp(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/zorp _______________________________________________ zorp mailing list zorp(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/zorp _______________________________________________ zorp mailing list zorp(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/zorp _______________________________________________ zorp mailing list zorp(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/zorp

1 0

RE: [zorp] tproxy problem
by Mark Nadir 20 Jul '05

20 Jul '05

Yah I traced that as the problem - I don't have either - which is strange since the kernel was compiled and built successfully. I am wondering if the cttproxy patch only applies to iptables 1.2.7 -----Original Message----- From: zorp-bounces(a)lists.balabit.hu [mailto:zorp-bounces@lists.balabit.hu] On Behalf Of Zhou Li Sent: July 19, 2005 11:23 PM To: Zorp users mailing list Subject: Re: [zorp] tproxy problem so you got files /lib/iptables/libipt_TPROXY.so and /lib/iptables/libipt_tproxy.so in your system? I has met the same problem when I using zorp first time, and I found reason finally was missing the two files. ----- Original Message ----- From: "Mark Nadir" <mnadir(a)cyrca.net> To: "Zorp users mailing list" <zorp(a)lists.balabit.hu> Sent: Wednesday, July 20, 2005 10:42 Subject: RE: [zorp] tproxy problem Actually zhou, I got iptables-1.2.11 and applied the patch in the source of same. -----Original Message----- From: zorp-bounces(a)lists.balabit.hu [mailto:zorp-bounces@lists.balabit.hu] On Behalf Of Zhou Li Sent: July 19, 2005 10:17 PM To: Zorp users mailing list Subject: Re: [zorp] tproxy problem I think you haven't applied iptables-1.2.7a-cttproxy-04.diff for iptables, you can find it in cttproxy-2.4.30-2.0.1.tar.gz, Mark. //ZhouLi ----- Original Message ----- From: "Mark Nadir" <mnadir(a)cyrca.net> To: "Zorp users mailing list" <zorp(a)lists.balabit.hu> Sent: Wednesday, July 20, 2005 09:37 Subject: [zorp] tproxy problem Hi there I was wondering if anyone can help me figure out why tproxy doesn't seem to work. I am currently using the 2.4.31 kernel with t-proxy patch successfully applied. However, whenever I try to create an iptables statement to enable tproxy to listen on a port, I get the following messages: iptables v1.2.11: Unknown arg `--on-port' Try `iptables -h' or 'iptables --help' for more information. An lsmod reveals the following: Module Size Used by Not tainted ipt_limit 888 6 (autoclean) ipt_state 536 28 (autoclean) iptable_tproxy 13312 0 (autoclean) (unused) ipt_LOG 3968 1 (autoclean) ipt_tproxy 504 0 (unused) iptable_filter 1740 1 (autoclean) iptable_nat 21466 1 (autoclean) [iptable_tproxy] ip_conntrack 25264 0 (autoclean) [ipt_state iptable_tproxy ipt_tproxy iptable_nat] iptable_mangle 2168 0 (autoclean) (unused) ip_tables 12128 10 [ipt_limit ipt_state iptable_tproxy ipt_LOG ipt_tproxy iptable_filter iptable_nat iptable_mangle] Anyone know why my tproxy statement returns this error of unknown argument? Thanks in advance. Regards, Mark. _______________________________________________ zorp mailing list zorp(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/zorp _______________________________________________ zorp mailing list zorp(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/zorp _______________________________________________ zorp mailing list zorp(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/zorp _______________________________________________ zorp mailing list zorp(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/zorp

2 1

RE: [zorp] tproxy problem
by Mark Nadir 20 Jul '05

20 Jul '05

Actually zhou, I got iptables-1.2.11 and applied the patch in the source of same. -----Original Message----- From: zorp-bounces(a)lists.balabit.hu [mailto:zorp-bounces@lists.balabit.hu] On Behalf Of Zhou Li Sent: July 19, 2005 10:17 PM To: Zorp users mailing list Subject: Re: [zorp] tproxy problem I think you haven't applied iptables-1.2.7a-cttproxy-04.diff for iptables, you can find it in cttproxy-2.4.30-2.0.1.tar.gz, Mark. //ZhouLi ----- Original Message ----- From: "Mark Nadir" <mnadir(a)cyrca.net> To: "Zorp users mailing list" <zorp(a)lists.balabit.hu> Sent: Wednesday, July 20, 2005 09:37 Subject: [zorp] tproxy problem Hi there I was wondering if anyone can help me figure out why tproxy doesn't seem to work. I am currently using the 2.4.31 kernel with t-proxy patch successfully applied. However, whenever I try to create an iptables statement to enable tproxy to listen on a port, I get the following messages: iptables v1.2.11: Unknown arg `--on-port' Try `iptables -h' or 'iptables --help' for more information. An lsmod reveals the following: Module Size Used by Not tainted ipt_limit 888 6 (autoclean) ipt_state 536 28 (autoclean) iptable_tproxy 13312 0 (autoclean) (unused) ipt_LOG 3968 1 (autoclean) ipt_tproxy 504 0 (unused) iptable_filter 1740 1 (autoclean) iptable_nat 21466 1 (autoclean) [iptable_tproxy] ip_conntrack 25264 0 (autoclean) [ipt_state iptable_tproxy ipt_tproxy iptable_nat] iptable_mangle 2168 0 (autoclean) (unused) ip_tables 12128 10 [ipt_limit ipt_state iptable_tproxy ipt_LOG ipt_tproxy iptable_filter iptable_nat iptable_mangle] Anyone know why my tproxy statement returns this error of unknown argument? Thanks in advance. Regards, Mark. _______________________________________________ zorp mailing list zorp(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/zorp _______________________________________________ zorp mailing list zorp(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/zorp

2 1

tproxy problem
by Mark Nadir 20 Jul '05

20 Jul '05

Hi there I was wondering if anyone can help me figure out why tproxy doesn't seem to work. I am currently using the 2.4.31 kernel with t-proxy patch successfully applied. However, whenever I try to create an iptables statement to enable tproxy to listen on a port, I get the following messages: iptables v1.2.11: Unknown arg `--on-port' Try `iptables -h' or 'iptables --help' for more information. An lsmod reveals the following: Module Size Used by Not tainted ipt_limit 888 6 (autoclean) ipt_state 536 28 (autoclean) iptable_tproxy 13312 0 (autoclean) (unused) ipt_LOG 3968 1 (autoclean) ipt_tproxy 504 0 (unused) iptable_filter 1740 1 (autoclean) iptable_nat 21466 1 (autoclean) [iptable_tproxy] ip_conntrack 25264 0 (autoclean) [ipt_state iptable_tproxy ipt_tproxy iptable_nat] iptable_mangle 2168 0 (autoclean) (unused) ip_tables 12128 10 [ipt_limit ipt_state iptable_tproxy ipt_LOG ipt_tproxy iptable_filter iptable_nat iptable_mangle] Anyone know why my tproxy statement returns this error of unknown argument? Thanks in advance. Regards, Mark.

2 1

Channel read timed out
by Zhou Li 14 Jul '05

14 Jul '05

There are too many record like "(...http/client): Channel read timed out" in Zorp log, How can I disable recording the "Channel read timed out" message? any help will be appriciate ZhouLi

2 2

RE: [zorp] Cannot find ZORP Lowlevel library version >= 3.0.6: ispkg-config in path?
by Mark Nadir 08 Jul '05

08 Jul '05

Thanks Balazs: Worked like a charm! -----Original Message----- From: zorp-bounces(a)lists.balabit.hu [mailto:zorp-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: July 8, 2005 5:34 AM To: Zorp users mailing list Subject: Re: [zorp] Cannot find ZORP Lowlevel library version >= 3.0.6: ispkg-config in path? On Thu, 2005-07-07 at 13:05 -0500, Mark Nadir wrote: > Hi all > > I am trying to compile Zorp-GPL-3.0.5. > > As instructed I first installed libzorp-3.0.6 - that worked without a > hitch. > > When trying to compile the main Zorp, I get the following message: > > Package zorplibll was not found in the pkg-config search path. > Perhaps you should add the directory containing 'zorplibll.pc' to the > PKG_CONFIG_PATH environment variable. > No Package zorblibll found > Configure:Cannot find ZORP Lowlevel library version >= 3.0.6: is > pkg-config in path? > > Question: how in the heck do I do that, and what do I need to do to > resolve this? libzorpll was probably installed in /usr/local, in which case the pkg-config files were installed under /usr/local/lib/pkg-config, set PKG_CONFIG_PATH appropriately, e.g. PKG_CONFIG_PATH=/usr/local/lib/pkg-config ./configure -- Bazsi _______________________________________________ zorp mailing list zorp(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/zorp

1 0

tproxy patch and Julian's route patch
by Mark Nadir 08 Jul '05

08 Jul '05

Hi Bazsi, I am trying to compile a 2.4.31 kernel to support both tproxy for Zorp, and Julian's route patch. However, when I apply both patches, ip_nat_core.c and ip_nat_core.h won't compile. I receive error messages to the effect that the ip_nat_tuple has already been defined, etc. Do you have any suggestions on how to get the two patches to co-exist, and result in a clean compile of netfilter's ip_nat? Thanks in advance. Mark.

1 0