Hey Vieri, I think it's specific to your distro since... it exists in the netfilter sources as you can see at: https://github.com/torvalds/linux/blob/4ac4d584886a4f47f8ff3bca0f32ff9a2987d3e5/net/netfilter/xt_socket.c Squid doesn't use it directly but the iptables rules for tproxy to work requires this module to be available. It is used to identify which connections are local socket and not incoming connections and if these are local sockets these will not be hijacked by tproxy and will be treated like a local connection. Without this you cannot use tproxy. To test if it exists you need to run the next command: $ iptables -t mangle -A PREROUTING -p tcp -m socket -j MARK --set-mark 1 And see what happens. If it works, then you have the module on your OS and it should be fine. Eliezer ---- http://ngtech.co.il/lmgtfy/ Linux System Administrator Mobile: +972-5-28704261 Email: eliezer@xxxxxxxxxxxx From: squid-users [mailto:squid-users-bounces@xxxxxxxxxxxxxxxxxxxxx] On Behalf Of Vieri Sent: Monday, October 2, 2017 22:54 To: squid-users@xxxxxxxxxxxxxxxxxxxxx Subject: squid and kernel options Hi, My distro's Squid package checks for the presence of several kernel config options. In particular, it checks for these: NF_CONNTRACK NETFILTER_XT_MATCH_SOCKET NETFILTER_XT_TARGET_TPROXY However, in recent kernels such as 4.12.12, it seems that the following option is not available anymore: NETFILTER_XT_MATCH_SOCKET How does Squid use this kernel config option, and how can I be affected by its absence? Thanks, Vieri _______________________________________________ squid-users mailing list squid-users@xxxxxxxxxxxxxxxxxxxxx http://lists.squid-cache.org/listinfo/squid-users
