[tproxy] Tproxy request getting timed-out

[Karthik Vembar]

Hi

I am running squid 3.1.15 , kernel version 2.6.32-33-server , Iptables
version v1.4.4. I followed the instrcution given on When the client browse
using this Squid as gateway, request are getting timed out with following in
access.log

1315384947.854  60225 xx.xx.xx.xx TCP_MISS/000 0 GET
http://www.google.co.in/url? - DIRECT/www.google.co.in -
1315384949.431 117995 xx.xx.xx.xx TCP_MISS/000 0 GET
http://www.google.co.in/url? - DIRECT/www.google.co.in -

where xx.xx.xx.xx are client Public Ips

Following is the squid setup

1) Network configuration

Router ---> squid (eth0 - Public IP) --> Client (Public IP)

sysctl -p
net.ipv4.conf.default.rp_filter = 1
net.ipv4.ip_forward = 1

cat /boot/config-2.6.32-33-server |grep -E
'(NF_CONNTRACK=|TPROXY|XT_MATCH_SOCKET|XT_TARGET_TPROXY)'
CONFIG_NF_CONNTRACK=m
CONFIG_NETFILTER_TPROXY=m
CONFIG_NETFILTER_XT_TARGET_TPROXY=m
CONFIG_NETFILTER_XT_MATCH_SOCKET=m


iptables -L -t mangle
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination
DIVERT     tcp  --  anywhere             anywhere            socket
TPROXY     tcp  --  anywhere             anywhere            tcp dpt:www
TPROXY redirect 0.0.0.0:3129 mark 0x1/0x1

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination

Chain DIVERT (1 references)
target     prot opt source               destination
MARK       all  --  anywhere             anywhere            MARK xset
0x1/0xffffffff
ACCEPT     all  --  anywhere             anywhere


from squid.conf

http_port 3129 tproxy

from dmesg

[62387.197490] nf_conntrack version 0.5.0 (16384 buckets, 65536 max)
[62387.197746] CONFIG_NF_CT_ACCT is deprecated and will be removed soon.
Please use
[62387.197749] nf_conntrack.acct=1 kernel parameter, acct=1 nf_conntrack
module option or
[62387.197752] sysctl net.netfilter.nf_conntrack_acct=1 to enable it.
[62387.242358] NF_TPROXY: Transparent proxy support initialized, version
4.1.0
[62387.242362] NF_TPROXY: Copyright (c) 2006-2007 BalaBit IT Ltd.

Browsing is happening fine in transparent mode using http_port 3128
transparent..

Please help....


-- 
Karthik Vembar


“Condemn none: if you can stretch out a helping hand, do so. If you cannot,
fold your hands, bless your brothers, and let them go their own way.” Swami
Vivekananda
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/tproxy/attachments/20110908/d8823df9/attachment.htm