[tproxy] TPROXY + Cisco Firewall

[Jojy Varghese]

Hi 
  Thanks for your response. I am able to get the traffic
redirected to my proxy server port. But the whole behavior is as if the
tproxy kernel patch is not applied. In other words, on the web server I
see that the request is coming from my proxy server and not from the
client. The client IP is not getting rewritten after the socket options are applied.

 Also, I am observing that if I set the "itp.v.addr.fport" to 0, the proxy server doesnt even get the request from the client.(Here itp is a variable of type struct in_tproxy). So I had to assign the fport to a valid non-zero number.

Any help is much appreciated.

thanks again,
Jojy

####
Message: 1
Date: Mon, 13 Aug 2007 10:13:15 +0200
From: Laszlo Attila Toth <panther at balabit.hu>
Subject: Re: [tproxy] TPROXY + Cisco Firewall
To: tproxy at lists.balabit.hu
Message-ID: <200708131013.16001.panther at balabit.hu>
Content-Type: text/plain;  charset="utf-8"

On Sunday 12 August 2007 00.28.07 Jojy Varghese wrote:
> Hi all
> 3.
> I have verified my changes by creating a REDIRECTION rule in the tproxy
> chain (can list my iptable changes by doing "iptables -t tproxy -L")

Hello,

For instance a client try to connect to a webserver somewhere on the Internet 
listening on port 80, and your proxy is listening on port 50080. The iptables 
rule that redirects packets to that port is the following:

    iptables -t tproxy -p tcp --dport 80 -j TPROXY --on-port 50080

The next one is to allow incomming traffic on that port. Because the TPROXY 
target marks the packet, the following rule accepts these packets:

    iptables -t filter -A INPUT -m tproxy -j ACCEPT

A tutorial is available here:
    http://www.balabit.hu/network-security/zorp-gateway/gpl/tutorial/


-- 
Regards,
    Laszlo Attila Toth


------------------------------

_______________________________________________
tproxy mailing list
tproxy at lists.balabit.hu
https://lists.balabit.hu/mailman/listinfo/tproxy


End of tproxy Digest, Vol 26, Issue 11
**************************************







      ____________________________________________________________________________________
Shape Yahoo! in your own image.  Join our Network Research Panel today!   http://surveylink.yahoo.com/gmrs/yahoo_panel_invite.asp?a=7 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/tproxy/attachments/20070813/3b46021a/attachment.htm