Hey,
Depends on your OS you will need to installthe ipset package.
Try to run “apt-get install ipset”.
And then run the script.
Eliezer
----
<Untitled Attachment 1.jpg>
Amos, thanks for the reply.
This is getting more confusing.
And I ran it, but I am getting errors:
… this goes on the same for all the domains in the text file
I did not quite understand what you meant by
You should test whether -m set or -m socket work faster and put that one
first. My change above places it at line 2 (after -m socket) assuming
your iptables script is still <http://pastebin.com/SqpbmYQQ>
should I incorporate the bypass script into my iptables.sh script? run iptables first then bypass?
On a side note, would adding ssl_bump exceptions to squid.conf do it?
Something like:
acl skype_domains <path to file>
ssl_bump splice skype_domains
ssl_bump bump all
Again, thanks again for your help.
<Untitled Attachment 2.jpg> Piensa
en el medio ambiente antes de imprimir este email.
On 7/12/2016 3:19 a.m., Sameh Onaissi wrote:
Hello,
I tried doing the changes to nat/REDIRECT in iptables.sh and I must have messed up somewhere, so I am sticking with mangle/tproxy for now since squid is working with them.
How can I change Eliezer’s script to mangle/tproxy? https://gist.github.com/elico/e0faadf0cc63942c5aaade808a87deef
Excuse my novice knowledge in iptables.
No worries.
You need to change where iptables attaches the 'bypasspool'. Both the
table/location (-t) and the jump/action (-j).
iptables -t mangle -L PREROUTING |grep bypasspool
if [ "$?" -ne "0" ];then
iptables -t mangle -I 2 PREROUTING \
-m set --match-set bypasspool dst,src \
-j DIVERT
fi
You should test whether -m set or -m socket work faster and put that one
first. My change above places it at line 2 (after -m socket) assuming
your iptables script is still <http://pastebin.com/SqpbmYQQ>
(Your script should do that line adding, not Eliezers - so that you can
be sure the order is always correct).
BTW: you should use iptables-save / iptables-restore instead of a slow
script calling iptables "manually". Those other tools will ensure there
are no gaps in the firewall initialization for nasty traffic to sneak
through.
I am looking at access.log to collect all domains I see heading to skype for business, as well as IPs. My question is, can I add the domains AND IPs into the domains-to-bypass.txt that the above script uses?
IIRC you should be able to use domain as the parameter to ipset. But it
will resolve the domain immediately and only add those IPs that it finds
at that time into the pool. Any future changes, or a hidden set of IPs
that rotate in/out will not be listed.
Amos
Piensa
en el medio ambiente antes de imprimir este email. 