- zorp - lists.balabit.hu

Zorp and Traffic Control
by Philippe Lucas 19 May '03

19 May '03

confirm 587515 I would like make a transparent proxy, transparent for both the client and the server. But my problem is that the transparency works for the client but not for the server. Could you please help me ? My configuration : client ------------- tproxy+zorp2.0 (debian woody) ----------------- server 192.168.100.199 192.168.100.135 192.168.0.134 192.168.0.251 My policy.pl : from Zorp.Core import * from Zorp.Plug import * from Zorp.Http import * Zorp.firewall_name = 'zorp@site' InetZone("site-net", "192.168.100.0/24", outbound_services=["intra_http"], inbound_services=[]) InetZone("local", "127.0.0.1/8", inbound_services=["*"], outbound_services=[]) InetZone("internet", "0.0.0.0/0", inbound_services=["*"], outbound_services=[]) class IntraHttp(HttpProxy): def config(self): HttpProxy.config(self) self.transparent_mode = TRUE def zorp_http(): Service("intra_http", IntraHttp,router=TransparentRouter(forge_addr=TRUE)) Listener(SockAddrInet("192.168.100.135", 50080), "intra_http") My iptables.conf : *filter -P FORWARD ACCEPT -A INPUT -m tproxy -j ACCEPT COMMIT *tproxy :PREROUTING ACCEPT :OUTPUT ACCEPT :PRintra - -A PREROUTING -i eth0 -d ! 192.168.100.135 -j PRintra -A PRintra -p tcp --dport 80 -j TPROXY --on-port 50080 COMMIT Philippe LUCAS

2 1

https reverse proxy
by Peter Hicks 18 Apr '03

18 Apr '03

Hi, I was wondering if someone could help me with setting up https proxying with zorp. I would like zorp to be able to proxy based on domain name, as I have a limited number of external IPs. I figured I could set up unlimited https servers on internalRFC1918 addresses and have zorp reverse proxy them. https foo1.com(10.1.1.1) -> 192.168.1.5 https foo2.com(10.1.1.1) -> 192.168.1.6 https foo3.com(10.1.1.1) -> 192.168.1.7 Does this make sense? I am still trying to get a handle on zorp's configuration files, so if you could include some examples, I would be very grateful. TIA! :^P -- Peter Hicks GnuPG public key: http://jah.net/~petong/public_key.txt Key Fingerprint: 4E24 3C78 A165 537C 729C 8D25 3547 3CE9 9E7D 42B6 Truth suffers from too much analysis.

2 1

Zorp and Traffic Control
by c0g 01 Apr '03

01 Apr '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi! Could Zorp work as "real" transparent proxy, so neither client nor server will see its IP address? I need this for per ip bandwidth limiting. This example ilustrate this: client1 ----- zorp_transparent_firewall ----- internet ----- server client2 .. clientn Clients have _public_ IPs. Is this possible: When client connects to server, zorp intercept that connection, does protocol analysis etc., and then connents to server as _client_ IP. So, server sees in its log, that connection was made by client, not Zorp machine. If Zorp could do this, I could set per ip bandwitdh limiting (cbq rules) on both firewall interfaces, not only on internal NIC. Therefore outgoing traffic would be shaped too. - -- c0g(a)wp.pl -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQE+iCWLPqmVt5WhbA8RAmADAJ0UdLDd7epAp0p5A8m4Jm7phOUXWACeKwva k7sDDpPqozPAww6vqoMyW7w= =QRJL -----END PGP SIGNATURE-----

4 5

zorp on a bridge
by Robert Penz 31 Mar '03

31 Mar '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi! I'm trying to setup zorp on an bridge, my problem is that I get this error messages Mar 27 14:19:51 debian intern[3197]: (noname/nosession): Verbosity level: 3 Mar 27 14:19:51 debian extern[3207]: (noname/nosession): Verbosity level: 3 Mar 27 14:19:51 debian intern[3197]: (noname/nosession): bind() failed; error='No such file or directory' Mar 27 14:19:51 debian extern[3207]: (noname/nosession): bind() failed; error='No such file or directory my configs instances.conf: intern -v3 -p /etc/zorp/policy.py --autobind-ip autobind='1.1.1.1' extern -v3 -p /etc/zorp/policy.py --autobind-ip autobind='1.1.1.2' policy.py: from Zorp.Core import * from Zorp.Http import * InetZone('intern', '10.156.1.0/24', outbound_services=['intern_HTTP']) InetZone('extern', '0.0.0.0/0', inbound_services=['intern_HTTP']) def intern(): Service('intern_HTTP', HttpProxy) Listener(SockAddrInet('10.156.1.253', 50080), 'intern_HTTP') def extern(): pass # ifconfig br0 Link encap:Ethernet HWaddr 00:10:5A:A1:02:60 inet addr:10.156.1.253 Bcast:10.156.1.255 Mask:255.255.255.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:23611 errors:0 dropped:0 overruns:0 frame:0 TX packets:10379 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:6080267 (5.7 MiB) TX bytes:1763635 (1.6 MiB) dummy0 Link encap:Ethernet HWaddr 00:00:00:00:00:00 inet addr:1.1.1.1 Bcast:1.255.255.255 Mask:255.255.255.255 UP BROADCAST RUNNING NOARP MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:0 (0.0 b) TX bytes:0 (0.0 b) dummy1 Link encap:Ethernet HWaddr 00:00:00:00:00:00 inet addr:1.1.1.2 Bcast:1.255.255.255 Mask:255.255.255.255 UP BROADCAST RUNNING NOARP MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:0 (0.0 b) TX bytes:0 (0.0 b) eth0 Link encap:Ethernet HWaddr 00:60:08:CA:33:1B UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:31576 errors:0 dropped:0 overruns:0 frame:0 TX packets:14942 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:100 RX bytes:12715003 (12.1 MiB) TX bytes:2462412 (2.3 MiB) Interrupt:5 Base address:0xb000 eth1 Link encap:Ethernet HWaddr 00:10:5A:A1:02:60 UP BROADCAST MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:7095 errors:0 dropped:0 overruns:0 carrier:7095 collisions:0 txqueuelen:100 RX bytes:0 (0.0 b) TX bytes:427400 (417.3 KiB) Interrupt:10 Base address:0xa800 lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 UP LOOPBACK RUNNING MTU:16436 Metric:1 RX packets:12 errors:0 dropped:0 overruns:0 frame:0 TX packets:12 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:1136 (1.1 KiB) TX bytes:1136 (1.1 KiB) and one question I also have is: Do I really need to do that via dummy devices? or is there a better way? - -- Regards, Robert - ---------------- Robert Penz robert.penz AT outertech.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE+gvyg8tTsQqJDUBMRAkPpAJ46vLgVr18GIpgVw5U/wP9am4rldQCeMp6Q JL77DOrs+Wmq1EkGmSHGOjY= =5fI/ -----END PGP SIGNATURE-----

3 3

iptables-utils
by Peter Hicks 29 Mar '03

29 Mar '03

Hello, I have just installed zorp on a debian woody machine using the src downloads. I am looking over the tutorial to get an understanding of how to configure zorp, but I can't seem to find the iptables-utils to create the firewall rules. -Peter

2 1

Live Webinar - Surrender is Not an Option
by Bodacion Technologies 07 Mar '03

07 Mar '03

_______________________________________________________________________ Powered by List Builder To unsubscribe follow the link: http://lb.bcentral.com/ex/sp?c=27695&s=550273F7B6AEBBAF&m=6

1 0

tproxy problem
by Tito Flagella 05 Mar '03

05 Mar '03

We are experiencing some problems using: - cttproxy, version cttproxy-2.4.18-10, applied without any apparent problem on a Linux 2.4.9-e.10 kernel, derived from the Redhat "Advanced Server" kernel. - zorp 2 We use an udp Plug proxy, defined as follows: def udp(): Service("udp", PlugProxy) Receiver(SockAddrInet("10.0.0.191", 20001), "udp") Receiver(SockAddrInet("192.168.1.1", 20001), "udp") Receiver(SockAddrInet("192.168.7.1", 20001), "udp") and used through iptables rules, like: [root@pif root]# iptables --list -t tproxy Chain PREROUTING (policy ACCEPT) target prot opt source destination TPROXY udp -- dmz.sede-pisa.link.it gondor.sede-pisa.link.it udp spts:1024:65535 dpt:domain TPROXY redirect 0.0.0.0:20001 TPROXY udp -- dmz.sede-pisa.link.it gondor.sede-pisa.link.it udp spt:domain dpt:domain TPROXY redirect 0.0.0.0:20001 ... With tcpdump, we observe that DNS queries coming from the internal networks (both from a DNS server from the 53 port and from DNS clients on non privileged ports) are sometimes redirected to the 20001 port, sometimes not. Obviously, when not redirected, zorp is not activated and the query doesn't work. Do you have any idea of what's wrong in our environment? Thanks a lot, tito.

1 0

RE: Don't forget to call me tonight!!
by Jenny MacOrton 22 Feb '03

22 Feb '03

1 0

Zorp GPL-VERSION
by Ivan Lopez 19 Feb '03

19 Feb '03

Hello: Congratulations for your product. First: Pardon for my English. I'm a beginner (in English, Zorp and Python) Second: I`ve intalled zorp 2.0.1 (GPL-VERSION!!!)in my linux box. I want to configure zorp as Reverse Proxy (is this posible with this version?). If it is, I´m having problems with my installation/configuration. Below are instances.conf and policy-http.py files: Instances.conf (grep -v ^.*# /etc/zorp/instances.conf) -------------- Zhttp --verbose=10 --policy /etc/zorp/policy-http.py policy-http.py (grep -v ^.*# /etc/zorp/policy-http.py) -------------- from Zorp.Zorp import * from Zorp import Zorp from Zorp.Zone import InetZone from Zorp.Service import Service from Zorp.SockAddr import SockAddrInet from Zorp.Chainer import DirectedChainer from Zorp import Http from Zorp.Http import HttpProxy from Zorp.Listener import Listener Zorp.firewall_name = 'zorp@bcpc' InetZone("cpc", "192.168.1.0/24", outbound_services=[], inbound_services=["INhttp"]), InetZone("local", "127.0.0.0/8", inbound_services=["*"], outbound_services=[]), InetZone("internet", "0.0.0.0/0", inbound_services=[], outbound_services=["INhttp"]) class INhttp(HttpProxy): def config(self): HttpProxy.config(self) self.transparent_mode = 0 def init(Zhttp): Service("INhttp", DirectedChainer(SockAddrInet("192.168.1.100", 80)),\ INhttp) Listener(SockAddrInet("aaa.bb.cc.ddd", 80), "INhttp") When zorp starts I obtain (tail -f syslog): -------------------------- Feb 18 19:38:47 bcpc Zhttp[6578]: (noname/nosession): Verbosity level: 100 Feb 18 19:38:47 bcpc Zhttp[18175]: (Log thread): thread starting; Feb 18 19:38:47 bcpc Zhttp[6578]: (noname/nosession): System dependant init; sysdep_tproxy='1' Feb 18 19:38:47 bcpc Zhttp[6578]: (noname/nosession): Changing process capabilities; caps='= cap_net_bind_service+ep cap_net_admin+p' Feb 18 19:38:47 bcpc Zhttp[6578]: (noname/nosession): Changing process capabilities; caps='= cap_net_bind_service,cap_net_admin+ep' Feb 18 19:38:47 bcpc Zhttp[6578]: (noname/nosession): bind() failed; error='No such file or directory' Feb 18 19:38:47 bcpc Zhttp[6578]: (noname/nosession): Resetting process capabilities; caps='= cap_net_bind_service,cap_net_admin+p' Feb 18 19:38:47 bcpc Zhttp[31782]: (conntrack/thread): thread starting; Feb 18 19:38:48 bcpc Zhttp[6578]: zorp version 2.0.0 starting up Feb 18 19:38:48 bcpc Zhttp[18175]: (Log thread): Policy bootstrapping... Feb 18 19:38:48 bcpc Zhttp[18175]: (Log thread): Traceback (most recent call last): Feb 18 19:38:48 bcpc Zhttp[18175]: (Log thread): File "/etc/zorp/policy-http.py", line 24, in ? Feb 18 19:38:48 bcpc Zhttp[6578]: (noname/nosession): Error loading initial policy, exiting; Feb 18 19:38:48 bcpc Zhttp[6578]: zorp version 2.0.0 going down. Feb 18 19:38:48 bcpc Zhttp[18175]: (Log thread): from Zorp.Chainer import DirectedChainer Feb 18 19:38:48 bcpc Zhttp[18175]: (Log thread): ImportError: cannot import name DirectedChainer Feb 18 19:38:48 bcpc Zhttp[31782]: (conntrack/thread): thread exiting; I don't know why bind() fails and I don't know why DirectedChainer is not in /usr/share/zorp/pylib/Zorp/Chainer.py. Here is the output for (grep .*class in this file): class AbstractChainer: class ConnectChainer(AbstractChainer): class FailoverChainer(ConnectChainer): class SideStackChainer(AbstractChainer): My environment is: Debian 3.0.0 r0 (woody) python 2.1.3-3 python-extclass 1.2-5 Zorp 2.0.0-1 Zorp-modules 2.0.0-1 libzorpll 2.0.18.4-1 libglib2 2.0.6-1 NOTE: When I install zorp I run: dpkg -i --ignore-depends=libzorpll zorp_2.0-1_i386.deb because zorp depends from libzorpll and libzorpll depends from zorp. Is this cycle OK or I've misintalled zorp? I can't find the error in my installation/configuration. Can you help me? Best Regards. Ivan Lopez Santa Fe - Argentina _________________________________________________________________ Charla con tus amigos en línea mediante MSN Messenger: http://messenger.yupimsn.com/

2 1

(광고) 이웃사랑실천 SW 제공
by 894백화점 11 Feb '03

11 Feb '03

1 0