if you have a Thread you better stick to it.
my tproxy setup on ubunutu 11.10 amd64
i'm using one script to start the tproxy services on this machine.
i have seen things about the ebtables should be on DROP but the only way
i could make it work was to accept the connections with EBTABLES.
as i remember you might need to add a "ACCEPT" rules before the "DROP"
ones in the ebtables.
this script is from couple of month ago but it worked perfectly.
hope it will help you.
#!/bin/sh -x
#turning iptables modules on
modprobe ip_tables
modprobe iptable_filter
modprobe iptable_mangle
modprobe xt_mark
modprobe xt_socket
modprobe nf_tproxy_core
modprobe xt_TPROXY
modprobe xt_tcpudp
modprobe nf_conntrack
modprobe nf_conntrack_ipv4
#building bridge
ifconfig eth0 0.0.0.0
ifconfig eth1 0.0.0.0
pkill dhc
ifconfig eth0 up
ifconfig eth1 up
brctl addbr br0
brctl addif br0 eth0
brctl addif br0 eth1
ifconfig br0 192.168.10.119
#adding route for bridge
route add default gw 192.168.10.201
#
echo "nameserver 192.168.10.201">/etc/resolv.conf
#tproxy settings
ip route flush table 100
ip rule del fwmark 1 lookup 100
ip rule add fwmark 1 lookup 100
ip -f inet route add local 0.0.0.0/0 dev lo table 100
iptables -t mangle -F
iptables -t mangle -X DIVERT
iptables -t mangle -N DIVERT
iptables -t mangle -A DIVERT -j MARK --set-mark 1
iptables -t mangle -A DIVERT -j ACCEPT
iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT
iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY
--tproxy-mark 0x1/0x1 --on-port 3129
##!/bin/sh
CLIENT_IFACE="eth1"
INET_IFACE="eth0"
ebtables -t broute -F
ebtables -t broute -A BROUTING -i $CLIENT_IFACE -p ipv4 --ip-proto tcp
--ip-dport 80 -j redirect --redirect-target ACCEPT
ebtables -t broute -A BROUTING -i $CLIENT_IFACE -p ipv4 --ip-proto tcp
--ip-dport 80 -j redirect --redirect-target DROP
ebtables -t broute -A BROUTING -i $INET_IFACE -p ipv4 --ip-proto tcp
--ip-sport 80 -j redirect --redirect-target ACCEPT
ebtables -t broute -A BROUTING -i $INET_IFACE -p ipv4 --ip-proto tcp
--ip-sport 80 -j redirect --redirect-target DROP
cd /proc/sys/net/bridge/
for i in *
do
echo 0 > $i
done
unset i
#Changes in /etc/sysctl.conf \ sysctl
sysctl net.ipv4.ip_forward=1
sysctl net.netfilter.nf_conntrack_acct=1
sysctl net.ipv4.conf.lo.rp_filter=0
On 03/05/2012 04:32, Daniel Echizen wrote:
Hi list..
A already hav posted my problem in the list before, but i'll try to
put more detail after alot of research.
My problem is, i have a squidbox working as a tproxy, all work fine
except some clients that have wireless router (tplink and another
brand) sharing their connection.
my topology is internet<----> squidbox (bridge)<----> mikrotik
(pppoe-server)<-----> clients
squidbox under debian lenny 5.0, kernel version 3.3.4, iptables
1.4.13, ebtables 2.0.10-4, squid 3.1
squidbox is the gateway but i have tested without too.
in tcpdump i can see that connection from the problematic client dies
after syn/ack like above:
06:17:49.782874 IP 177.x.x.182.41375> 177.43.198.34.80: S
2780380743:2780380743(0) win 8192<mss 1440,nop,nop,sackOK>
06:17:49.782898 IP 177.43.198.34.80> 177.x.x.182.41375: S
4043086738:4043086738(0) ack 2780380744 win 14600<mss
1460,nop,nop,sackOK>
06:17:50.815675 IP 177.x.x.182.41372> 74.125.234.73.80: S
3452097232:3452097232(0) win 8192<mss 1440,nop,wscale
2,nop,nop,sackOK>
06:17:50.815690 IP 74.125.234.73.80> 177.x.x.182.41372: S
3646761972:3646761972(0) ack 3452097233 win 14600<mss
1460,nop,nop,sackOK,nop,wscale 7>
06:17:50.929351 IP 177.43.198.34.80> 177.x.x.182.41375: S
4043086738:4043086738(0) ack 2780380744 win 14600<mss
1460,nop,nop,sackOK>
06:17:51.085337 arp who-has 177.x.x.182 tell 177.x.x.11
06:17:51.086195 arp reply 177.x.x.182 is-at 00:27:19:d4:b4:27
06:17:51.329317 IP 74.125.234.73.80> 177.x.x.182.41372: S
3646761972:3646761972(0) ack 3452097233 win 14600<mss
1460,nop,nop,sackOK,nop,wscale 7>
06:17:52.776117 IP 177.x.x.182.41375> 177.43.198.34.80: S
2780380743:2780380743(0) win 8192<mss 1440,nop,nop,sackOK>
06:17:52.776130 IP 177.43.198.34.80> 177.x.x.182.41375: S
4043086738:4043086738(0) ack 2780380744 win 14600<mss
1460,nop,nop,sackOK>
06:17:52.929358 IP 177.43.198.34.80> 177.x.x.182.41375: S
4043086738:4043086738(0) ack 2780380744 win 14600<mss
1460,nop,nop,sackOK>
177.x.x.182 is client IP
177.x.x.11 is squidbox IP
my config is:
ip rule add fwmark 1 lookup 100
ip route add local 0.0.0.0/0 dev lo table 100
/sbin/iptables -v -t mangle -N DIVERT
/sbin/iptables -v -t mangle -A DIVERT -j MARK --set-mark 1
/sbin/iptables -v -t mangle -A DIVERT -j ACCEPT
/sbin/iptables -v -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY
--tproxy-mark 0x1/0x1 --on-port 5128
/usr/local/sbin/ebtables -t broute -A BROUTING -i eth4 -p ipv4
--ip-proto tcp --ip-sport 80 -j redirect --redirect-target DROP
/usr/local/sbin/ebtables -t broute -A BROUTING -i eth3 -p ipv4
--ip-proto tcp --ip-dport 80 -j redirect --redirect-target DROP
cd /proc/sys/net/bridge/
for i in *
do
echo 0> $i
done
unset i
echo 0> /proc/sys/net/ipv4/conf/lo/rp_filter
echo 0> /proc/sys/net/ipv4/conf/all/rp_filter
echo 1> /proc/sys/net/ipv4/ip_forward
hope someone help.. dont know how to track where syn/ack is dying or
getting drop
--
Eliezer Croitoru
https://www1.ngtech.co.il
IT consulting for Nonprofit organizations
eliezer <at> ngtech.co.il
