On 23/10/19 1:23 am, Vieri Di Paola wrote: > On Tue, Oct 22, 2019 at 1:48 PM Amos Jeffries wrote: >> >> I do not see any DIVERT rule at all in your firewall config dump. That >> is at least part of the problem. > > I opened the previous dump and saw the divert rules here below: > > Chain PREROUTING (policy ACCEPT 573K packets, 462M bytes) > pkts bytes target prot opt in out source > destination > 573K 462M CONNMARK all -- * * 0.0.0.0/0 > 0.0.0.0/0 CONNMARK restore mask 0xff > 1213 181K routemark all -- ppp1 * 0.0.0.0/0 > 0.0.0.0/0 mark match 0x0/0xff > 3195 308K routemark all -- ppp2 * 0.0.0.0/0 > 0.0.0.0/0 mark match 0x0/0xff > 1320 79360 routemark all -- ppp3 * 0.0.0.0/0 > 0.0.0.0/0 mark match 0x0/0xff > 311K 277M tcpre all -- * * 0.0.0.0/0 > 0.0.0.0/0 mark match 0x0/0xff > 0 0 divert tcp -- ppp1 * 0.0.0.0/0 > 10.215.144.48 [goto] tcp spt:80 flags:!0x17/0x02 socket > --transparent > 0 0 divert tcp -- ppp2 * 0.0.0.0/0 > 10.215.144.48 [goto] tcp spt:80 flags:!0x17/0x02 socket > --transparent > 0 0 divert tcp -- ppp3 * 0.0.0.0/0 > 10.215.144.48 [goto] tcp spt:80 flags:!0x17/0x02 socket > --transparent > 76 7484 TPROXY tcp -- enp10s0 * 10.215.144.48 > 0.0.0.0/0 tcp dpt:80 TPROXY redirect 0.0.0.0:3129 mark > 0x200/0x200 > 0 0 divert tcp -- ppp1 * 0.0.0.0/0 > 10.215.144.48 [goto] tcp spt:443 flags:!0x17/0x02 socket > --transparent > 0 0 divert tcp -- ppp2 * 0.0.0.0/0 > 10.215.144.48 [goto] tcp spt:443 flags:!0x17/0x02 socket > --transparent > 0 0 divert tcp -- ppp3 * 0.0.0.0/0 > 10.215.144.48 [goto] tcp spt:443 flags:!0x17/0x02 socket > --transparent > 10 1060 TPROXY tcp -- enp10s0 * 10.215.144.48 > 0.0.0.0/0 tcp dpt:443 TPROXY redirect 0.0.0.0:3130 mark > 0x200/0x200 > > Aren't these the DIVERT rules you are referring to? > Oh, case sensitivity. I was grep'ing for the upper case chain name. So you have a 'divert' chain. First problem with these rules is they depend on an IP address. IP is the one detail guaranteed not to match properly when TPROXY spoofing is going on. Second problem is that they also depend on a source port number of 80 or 443. The traffic needing to be marked comes from both directions, so this will break half the traffic flow. Third is that you are using the --transparent option. If I am understanding it correctly, that will cause the connections out of Squid (which are marked as transparent) to skip divert action and hit the TPROXY intercept all over again - infinite loop. Amos _______________________________________________ squid-users mailing list squid-users@xxxxxxxxxxxxxxxxxxxxx http://lists.squid-cache.org/listinfo/squid-users
