ShirazOnline
Results 1 to 7 of 7

Thread: آموزش راه اندازی tproxy

  1. #1
    کاربر عادی mt22's Avatar
    Join Date
    Jul 2010
    Posts
    220
    Post Thanks / Like

    Default آموزش راه اندازی tproxy

    سلام لطفا اموزش tproxy را بگذارید ممنون

  2. # ADS
    Circuit advertisement
    Join Date
    Always
    Posts
    Many
     

  3. #2
    کاربر مستعد omid2007's Avatar
    Join Date
    Feb 2009
    Posts
    478
    Post Thanks / Like

    Default

    احتراما " تمام شده است
    Last edited by omid2007; 2010/08/10 at 02:26 AM.
    --



  4. #3
    کاربر مستعد omid2007's Avatar
    Join Date
    Feb 2009
    Posts
    478
    Post Thanks / Like

    Default

    TPROXY version 4.1


    • Goal: Support current TPROXYv4.1+ with full IPv4 and IPv6 transparent interception of HTTP.
    • Version: 3.1
    • Developer: Laszlo Attilla Toth (Balabit), Krisztian Kovacs, [Only Registered and Activated Users Can See Links. Click Here To Register...]
    • More: [Only Registered and Activated Users Can See Links. Click Here To Register...]

    Contents

    1. [Only Registered and Activated Users Can See Links. Click Here To Register...]
      1. [Only Registered and Activated Users Can See Links. Click Here To Register...]
      2. [Only Registered and Activated Users Can See Links. Click Here To Register...]
        1. [Only Registered and Activated Users Can See Links. Click Here To Register...]

      3. [Only Registered and Activated Users Can See Links. Click Here To Register...]
      4. [Only Registered and Activated Users Can See Links. Click Here To Register...]
      5. [Only Registered and Activated Users Can See Links. Click Here To Register...]
      6. [Only Registered and Activated Users Can See Links. Click Here To Register...]
        1. [Only Registered and Activated Users Can See Links. Click Here To Register...]
        2. [Only Registered and Activated Users Can See Links. Click Here To Register...]

      7. [Only Registered and Activated Users Can See Links. Click Here To Register...]
      8. [Only Registered and Activated Users Can See Links. Click Here To Register...]
        1. [Only Registered and Activated Users Can See Links. Click Here To Register...]
        2. [Only Registered and Activated Users Can See Links. Click Here To Register...]
        3. [Only Registered and Activated Users Can See Links. Click Here To Register...]
        4. [Only Registered and Activated Users Can See Links. Click Here To Register...]


    2. [Only Registered and Activated Users Can See Links. Click Here To Register...]
      1. [Only Registered and Activated Users Can See Links. Click Here To Register...]
      2. [Only Registered and Activated Users Can See Links. Click Here To Register...]
      3. [Only Registered and Activated Users Can See Links. Click Here To Register...]
      4. [Only Registered and Activated Users Can See Links. Click Here To Register...]
      5. [Only Registered and Activated Users Can See Links. Click Here To Register...]
        1. [Only Registered and Activated Users Can See Links. Click Here To Register...]
        2. [Only Registered and Activated Users Can See Links. Click Here To Register...]

      6. [Only Registered and Activated Users Can See Links. Click Here To Register...]

    3. [Only Registered and Activated Users Can See Links. Click Here To Register...]



    Sponsor

    This feature was Sponsored by Balabit and developed by Laszlo Attilla Toth and [Only Registered and Activated Users Can See Links. Click Here To Register...]. Production tested and debugged with the help of Krisztian Kovacs and Nicholas Ritter.
    WCCPv2 configuration is derived from testing by Steven Wilton and Adrian Chadd. It has not changed significantly since older TPROXY.

    Minimum Requirements


    • Linux Kernel 2.6.28
      [Only Registered and Activated Users Can See Links. Click Here To Register...]
      [Only Registered and Activated Users Can See Links. Click Here To Register...]
      iptables 1.4.3
      [Only Registered and Activated Users Can See Links. Click Here To Register...]
      [Only Registered and Activated Users Can See Links. Click Here To Register...]
      Squid 3.1
      [Only Registered and Activated Users Can See Links. Click Here To Register...]
      [Only Registered and Activated Users Can See Links. Click Here To Register...]
      libcap-dev or libcap2-dev
      any
      libcap 2.09 or later
      any

      Kernel 2.6.32 is known to have a TPROXY problem. Until those are resolved, please use 2.6.30 or 2.6.31 for production machines, they seem to work properly. NP: the links above are an arbitrary sample from the expected working versions, and may be old in some cases. The web directories where the files sit allow you to browse to newer versions if you like. libcap2 is needed at run time. To build you need the developer versions (*-dev) to compile with Squid.


    IPv6 Support

    There is now some support available from Balabit for patched kernels and iptables to perform TPROXY with IPv6 protocol.
    [Only Registered and Activated Users Can See Links. Click Here To Register...] (HEAD) has been adjusted to use IPv6 on [Only Registered and Activated Users Can See Links. Click Here To Register...] set with the tproxy option when kernel support is available.

    Squid Configuration

    Configure build options

    ./configure --enable-linux-netfiltersquid.conf settings

    http_port 3128 http_port 3129 tproxy
    • NP: A dedicated squid port for tproxy is REQUIRED. The way TPROXYv4 works makes it incompatible with NAT interception, reverse-***** acceleration, and standard ***** traffic. The intercept, accel and related flags cannot be set on the same [Only Registered and Activated Users Can See Links. Click Here To Register...] with tproxy flag.
    • Obsolete --enable-tproxy option. Remains only for legacy v2.2 ctt ***** support.
    • NP: The Balabit document still refers to using options tproxy transparent. Do not do this. It was only needed short-term for a bug which is now fixed.


    Linux Kernel Configuration


    • Requires kernel built with the configuration options:


    NF_CONNTRACK=m NETFILTER_TPROXY=m NETFILTER_XT_MATCH_SOCKET=m NETFILTER_XT_TARGET_TPROXY=mSo far we have this:



    Routing configuration

    The routing features in your kernel also need to be configured to enable correct handling of the intercepted packets. Both arriving and leaving your system.

    ip rule add fwmark 1 lookup 100 ip route add local 0.0.0.0/0 dev lo table 100
    • Systems with strict localhost interface security boundaries require each interface to have a "table 100" entry for looking up packets via that device .

    On each boot startup set:

    echo 0 > /proc/sys/net/ipv4/conf/lo/rp_filter echo 1 > /proc/sys/net/ipv4/ip_forwardOr configure /etc/sysctl.conf:

    set net.ipv4.forwarding = 1
    iptables Configuration


    iptables on a Router device

    Setup a chain DIVERT to mark packets

    iptables -t mangle -N DIVERT iptables -t mangle -A DIVERT -j MARK --set-mark 1 iptables -t mangle -A DIVERT -j ACCEPTUse DIVERT to prevent existing connections going through TPROXY twice:

    iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERTMark all other (new) packets and use TPROXY to pass into Squid:

    iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 3129
    ebtables on a Bridging device

    You need to follow all the steps for setting up the Squid box as a router device. These bridging rules are additional steps to move packets from bridging mode to routing mode:

    • $CLIENT_IFACE and $INET_IFACE need to be replaced with the eth* NIC interface names facing the clients or Internet. Mind the line wrap. The following is two command lines.


    ebtables -t broute -A BROUTING -i $CLIENT_IFACE -p ipv4 --ip-proto tcp --ip-dport 80 -j redirect --redirect-target DROP ebtables -t broute -A BROUTING -i $INET_IFACE -p ipv4 --ip-proto tcp --ip-sport 80 -j redirect --redirect-target DROP cd /proc/sys/net/bridge/ for i in * do echo 0 > $i done unset i
    • The bridge interfaces also need to be configured with public IP addresses for Squid to use in its normal operating traffic (DNS, ICMP, TPROXY failed requests, peer requests, etc)
    • An alternative to assigning interfaces with IP addresses you may also configure the squid.conf [Only Registered and Activated Users Can See Links. Click Here To Register...], and [Only Registered and Activated Users Can See Links. Click Here To Register...] for minimal DNS and peer requests to use explicitly. Note that [Only Registered and Activated Users Can See Links. Click Here To Register...] will never be used on requests received with TPROXY.


    SELINUX Policy tuning

    On Linux versions with selinux enabled you also need to tune the selinux policy to allow Squid to use TPROXY. By default the SELINUX policy for Squid denies some of the operations needed for TPROXY. You can tune the policy to allow this by setting a couple selinux booleans:

    setsebool squid_connect_any=yes setsebool squid_use_tproxy=yesIf your version of the selinux policy is missing any of these then see the troubleshooting section for alternative approaches.

    WCCP Configuration (only if you use WCCP)


    • by Steve Wilton $ROUTERIP needs to be replaced with the IP Squid uses to contact the WCCP router.


    squid.conf

    It is highly recommended that these definitions be used for the two wccp services, otherwise things will break if you have more than one cache (specifically, you will have problems when the a web server's name resolves to multiple ip addresses).

    wccp2_router $ROUTERIP wccp2_forwarding_method gre wccp2_return_method gre wccp2_service dynamic 80 wccp2_service_info 80 protocol=tcp flags=src_ip_hash priority=240 ports=80 wccp2_service dynamic 90 wccp2_service_info 90 protocol=tcp flags=dst_ip_hash,ports_source priority=240 ports=80
    Router config

    On the router, you need to make sure that all traffic going to/from the customer will be processed by _both_ WCCP rules. The way we implement this is to apply:

    • WCCP service 80 applied to all traffic coming in from a customer-facing interface
    • WCCP service 90 applied to all traffic going out to a customer-facing interface.
    • WCCP exclude in rule to all traffic coming in from the *****-facing interface.

    For Example:

    interface GigabitEthernet0/3.100 description ADSL customers encapsulation dot1Q 502 ip address x.x.x.x y.y.y.y ip wccp 80 redirect in ip wccp 90 redirect out interface GigabitEthernet0/3.101 description Dialup customers encapsulation dot1Q 502 ip address x.x.x.x y.y.y.y ip wccp 80 redirect in ip wccp 90 redirect out interface GigabitEthernet0/3.102 description ***** servers encapsulation dot1Q 506 ip address x.x.x.x y.y.y.y ip wccp redirect exclude in
    Single Squid behind WCCP interceptor


    Cluster of Sibling Squid behind WCCP interceptor

    When two sibling peers are both behind a WCCP interception gateway and using TPROXY to spoof the client IP, the WCCP gateway will get confused by two identical sources and redirect packets at the wrong sibling.
    This is now resolved by adding the no-tproxy flag to the cluster sibling [Only Registered and Activated Users Can See Links. Click Here To Register...] lines. This disables TPROXY spoofing on requests which are received through another peer in the cluster.

    cache_peer ip.of.peer sibling 3128 0 no-tproxy ...
    Troubleshooting


    Squid not spoofing the client IP

    Could be a few things. Check cache.log for messages like those listed here in Troubleshooting.

    • The warning about missing libcap appears to be issued before cache.log is started. So does not always show up when Squid starts. Start testing this problem by making sure of that dependency manually.


    Stopping full transparency: Error enabling needed capabilities.

    Something went wrong while setting advanced privileges. What exactly, we don't know at this point. Unfortunately its not logged anywhere either. Perhaps your syslog or /var/log/messages log will have details recorded by the OS.

    Stopping full transparency: Missing needed capability support.

    libcap support appears to be missing. The library needs to be built into Squid so a rebuild is required after installed the related packages for your system.

    commBind: cannot bind socket FD X to X.X.X.X: (99) cannot assign requested address

    This error has many reasons for occurring.
    It might be seen repeatedly when Squid is running with TPROXY configured:

    • If the squid port receives traffic by other means than TPROXY interception.
      Ports using the tproxy flag MUST NOT receive traffic for any other mode Squid can run in.
    • If Squid is receiving TPROXY traffic on a port without the tproxy flag.
    • If the kernel is missing the capability to bind to any random IP.

    It may also be seen only at startup due to unrelated issues:



    Traffic going through Squid but the timing out

    This is usually seen when the network design prevents packets coming back to Squid.

    • Check that the Routing portion of the config above is set correctly.
    • Check that the DIVERT is done before TPROXY rules in iptables PREROUTING chain.


    Timeouts with Squid not running in the router directly


    • The above configuration assumes that squid is running on the router OR has a direct connection to the Internet without having to go through the capture router again. For both outbound and return traffic.

    If your network topology uses a squid box sitting the inside the router which passes packets to Squid. Then you will need to explicitly add some additional configuration.
    The WCCPv2 example is provided for people using Cisco boxes. For others we can't point to exact routing configuration since it will depend on your router. But you will need to figure out some rule(s) which identify the Squid outbound traffic. Dedicated router interface, service groups, TOS set by Squid [Only Registered and Activated Users Can See Links. Click Here To Register...], and MAC source have all been found to be useful under specific situations. IP address rules are the one thing guaranteed to fail.

    • We should not really need to say it; but these exception rules MUST be placed before any of the capture TPROXY/DIVERT rules.


    Wccp2 dst_ip_hash packet loops


    • by Michael Bowe

    Referring to the [Only Registered and Activated Users Can See Links. Click Here To Register...] settings detailed above.
    First method:

    • dst_ip_hash on 80
    • src_ip_hash on 90

    Ties a particular web server to a particular cache
    Second method:

    • src_ip_hash on 80
    • dst_ip_hash on 90

    Ties a particular client to a particular cache
    When using TPROXY the second method must be used. The problem with the first method is this sequence of events which starts to occur:
    Say a client wants to access [Only Registered and Activated Users Can See Links. Click Here To Register...], their PC resolves the address and gets x.x.x.1

    1. GET request goes off to the network, Cisco sees it and hashes the dst_ip.
    2. Hash for this IP points to cache-A
    3. Router sends the request to cache-A.

    This cache takes the GET and does another DNS lookup of that host. This time it resolves to x.x.x.2

    1. Cache sends request off to the !Internet
    2. Reply comes back from x.x.x.2, and arrives at the Cisco.
    3. Cisco does hash on src_ip and this happens to map to cache-B
    4. Reply arrives at cache-B and it doesn’t know anything about it. Trouble!


    selinux policy denials

    When configuring TPROXY support on Fedora 12 using the Squid shipped with Fedora selinux initially blocked Squid from usng the TPROXY feature.
    The quick fix is disabling selinux entirely, but this is not generally desired.
    A more permanent fix until the squid part of the selinux policy is updated is to make a custom selinux policy module allowing Squid access to the net operations is needs for TPROXY.

    # Temporarily set eslinux in permissive mode and test.. setenforce 0 service squid start # Make a request via Squid and verity that it works. service squid stop setenforce 1 # build & install selinux module based on the denials seen grep AVC.*squid /var/log/audit/autdit.log | audit2allow -M squidtproxy semodule -i squidtproxy.ppAlternatively you can download and install a precomposed policy module from [Only Registered and Activated Users Can See Links. Click Here To Register...]

    wget [Only Registered and Activated Users Can See Links. Click Here To Register...] checkmodule -M -m -o squidtproxy.mod squidtproxy.te semodule_package -o squidtproxy.pp squidtproxy.mod semodule -i squidtproxy.pp setsebool -P squid_connect_any true
    References


    • Older config how-to from before the kernel and iptables bundles were available... [Only Registered and Activated Users Can See Links. Click Here To Register...]
    • Shorewall Firewall Configuration [Only Registered and Activated Users Can See Links. Click Here To Register...]

    Last edited by omid2007; 2010/08/10 at 03:17 AM.
    --



  5. #4
    کاربر عادی mt22's Avatar
    Join Date
    Jul 2010
    Posts
    220
    Post Thanks / Like

    Default

    میشه فارسیشو بگید ؟

  6. #5
    کاربر عادی Zoup's Avatar
    Join Date
    Dec 2008
    Posts
    39
    Post Thanks / Like

    Default

    Quote Originally Posted by mt22 View Post
    سلام لطفا اموزش tproxy را بگذارید ممنون

    پیشنهاد نمیکنم استفاده کنید،‌ مشکل stability داره.

  7. #6
    کاربر مستعد omid2007's Avatar
    Join Date
    Feb 2009
    Posts
    478
    Post Thanks / Like

    Default

    Quote Originally Posted by Zoup View Post
    پیشنهاد نمیکنم استفاده کنید،‌ مشکل stability داره.
    من چیز بهتری سراغ ندارم
    --



  8. #7
    کاربر عادی Zoup's Avatar
    Join Date
    Dec 2008
    Posts
    39
    Post Thanks / Like

    Default

    منم همین طور :((

    اینا هم بیشتر گیر پچ‌های سمت کرنل‌اش ان.

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

علاقه مندی ها (Bookmarks)

علاقه مندی ها (Bookmarks)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •