Re: [squid-users] TProxy Setup

Dear Amos,

We just found a small software:
https://github.com/kristrev/tproxy-example

As the author put it:
The example transparent proxy application accepts TCP connections on
the specified port (set to 9876 in tproxy_test.h) and attempts a TCP
connection to the original host. If it is successful, the application
starts forwarding data between the two connections (using splice()).

So, we compiled it and ran it, on port 9876. Then changed the
iptables mangle rules WITH ONLY the port 9876, all others remaining as
they were.

Everything is working perfectly! So, is it safe to assume that
iptables & kernel is working perfectly? That there is a problem in
Squid?

Regards
HASSAN

On Sat, Jul 5, 2014 at 1:26 AM, Nyamul Hassan <nyamul_at_gmail.com> wrote:
>> That is the problem then. Something is blocking the traffic arriving at Squid listening port. selinux, rp_filter or ip_forward sysctl settings I usually find are the problem for this, although there have been a few cases where nobody could figure out why this was happening.
>>
>
> We might be approaching that magical situation where we do not know
> what is happening!
>
> rp_filter is set to 0 for all as follows:
>
> [root_at_proxy01 ~]# find /proc/sys/net/ipv4/ -iname rp_filter
> /proc/sys/net/ipv4/conf/all/rp_filter
> /proc/sys/net/ipv4/conf/default/rp_filter
> /proc/sys/net/ipv4/conf/lo/rp_filter
> /proc/sys/net/ipv4/conf/eth0/rp_filter
> /proc/sys/net/ipv4/conf/eth1/rp_filter
> [root_at_proxy01 ~]# find /proc/sys/net/ipv4/ -iname rp_filter -exec cat {} +
> 0
> 0
> 0
> 0
> 0
>
> IP Rule & Route list is as follows:
>
> [root_at_proxy01 ~]# ip rule list
> 0: from all lookup local
> 32765: from all fwmark 0x1 lookup squidtproxy
> 32766: from all lookup main
> 32767: from all lookup default
> [root_at_proxy01 ~]# ip route list table squidtproxy
> local default dev eth0 scope host
>
>>
>> see the /!\ notes under in the wiki page under the section about setting up the route table.
>>
>> The interface(s) to attach the table to is the one receiving the packets. From your description I suspect you will have two interfaces - one for each of Rtr1 and Rtr2.
>>
>> For debugging try setting it for each interfaces receiving traffic and see if TPROXY starts working.
>>
>
> While playing with the linux iptables / ip commands, I have come
> across an interesting situation.
>
> I modified the mangle rule to "mark as 111", and updated the "ip rule" to show:
> 32765: from all fwmark 0x6f lookup squidtproxy
>
> All other settings are unchanged.
>
> No other changes were made. Under this situation, my test client was
> getting web pages loaded! But, Squid was still not getting any
> requests! Seemed like regular routing of traffic! I have checked both
> routers, and confirmed that, traffic was passing through SquidBox, but
> Squid process was not seeing it. :-/
>
>
>>
>> Great. Thank you for these details. I am creating a Microtik wiki page based on them.
>>
>
> If there is anything that I can help you with regarding the Mikrotik
> (that's "k" for both characters) wiki page, I would be most obliged.
>
> Regards
> HASSAN
Received on Fri Jul 04 2014 - 21:02:56 MDT