[squid-users] TPROXY4 + Fedora 13

Hi Guys, first post.

I know there is a lot of material about configuring Squid in Interception Mode in the wiki / lists, like others I'm struggling to understand where problems might exist, currently I have only got as far as routing, ideally I would like a bridged solution. I want to describe completely what my configuration is I think this maybe useful to other users.

I have based my installation on the information on this page: http://wiki.squid-cache.org/Features/Tproxy4 Overall I think the posting is clear, I think it could be improved by adding commands that demonstrate whether the configuration just applied succeeded or not.

My approach is that ideally I could use a distro for the base and inherit everything I need without having to compile code / kernel / etc.

Using Fedora 13 I get the following binaries, comparing these to the prereqs the are all > the defined versions:

Kernel: 2.6.33.5-124
iptables: 1.4.7-2
Squid: 3.1.4-2
libcap: 2.17-1

The Fedora 13 distro has the following Kernel options set:

CONFIG_NF_CONNTRACK=y
CONFIG_NETFILTER_TPROXY=m
CONFIG_NETFILTER_XT_MATCH_SOCKET=m
CONFIG_NETFILTER_XT_TARGET_TPROXY=m

From the squid.spec from the src rpm shipped with Fedora 13 i.e. squid-3.1.4-2.fc13.src.rpm I can see that the enable linux netfilter is configured

...
...

%ifnarch ppc64 ia64 x86_64 s390x

   --with-large-files \

 %endif
--enable-linux-netfilter \

 --enable-referer-log \

 --enable-removal-policies="heap,lru" \

 --enable-snmp \

...
...

lsmod on the Squid Host shows tproxy module loaded.

Module Size Used by
sunrpc 192013 1
cpufreq_ondemand 8420 4
acpi_cpufreq 7477 1
freq_table 3851 2 cpufreq_ondemand,acpi_cpufreq
iptable_nat 5420 0
nf_nat 19059 1 iptable_nat
xt_TPROXY 2102 1
xt_socket 2525 1
nf_tproxy_core 2163 2 xt_TPROXY,xt_socket,[permanent]
xt_MARK 1007 1
iptable_mangle 3107 1
ip6t_REJECT 4055 2
nf_conntrack_ipv6 17513 2
ip6table_filter 2743 1
ip6_tables 16558 1 ip6table_filter
ipv6 267033 36 ip6t_REJECT,nf_conntrack_ipv6
uinput 7230 0
tg3 103314 0
pl2303 14822 0
usbserial 32421 1 pl2303
i3200_edac 3104 0
serio_raw 4539 0
edac_core 37487 2 i3200_edac
iTCO_wdt 10864 0
iTCO_vendor_support 2451 1 iTCO_wdt
i2c_i801 10086 0
microcode 17930 0
radeon 589438 0
ttm 53215 1 radeon
drm_kms_helper 23936 1 radeon
drm 169073 3 radeon,ttm,drm_kms_helper
i2c_algo_bit 4781 1 radeon
i2c_core 24507 5 i2c_i801,radeon,drm_kms_helper,drm,i2c_algo_bit

My setup is as follows:

Client (172.27.5.109) -> Squid Host (172.27.5.104) -> Gateway (172.27.5.1)

Internet access from Squid Host is working correctly.

# cat /proc/sys/net/ipv4/conf/lo/rp_filter; cat /proc/sys/net/ipv4/ip_forward
0
1

I modified the default /etc/squid/squid.conf and added the following:

acl our_networks src 172.27.1.0/24 172.27.2.0/24 172.27.3.0/24 172.27.4.0/24 172.27.5.0/24 172.27.6.0/24 172.27.7.0/24
http_access allow our_networks

...

# Squid normally listens to port 3128
http_port 3128
http_port 3129 tproxy

I was getting an error about TPROXY not being present, I disabled selinux as suggested in the wiki page and startup proceeded ok.

Start Squid and netstat the port 3128 is there and I can connect directly to it and get back content (access.log / cache.log content is as expected)

Completing the router configuration as per http://wiki.squid-cache.org/Features/Tproxy4#iptables on a Router device I get the following:

ip rule show
0: from all lookup local
32765: from all fwmark 0x1 lookup 100
32766: from all lookup main
32767: from all lookup default

NOTE, should there be more values here? If I do not run ip rule add fwmark 1 lookup 100 I get an empty response no values

# ip route list table 100
local default dev lo scope host

Note below as described in wiki DIVERT is before TPROXY in the PREROUTING.

/etc/init.d/iptables status
Table: nat
Chain PREROUTING (policy ACCEPT)
num target prot opt source destination

Chain POSTROUTING (policy ACCEPT)
num target prot opt source destination

Chain OUTPUT (policy ACCEPT)
num target prot opt source destination

Table: mangle
Chain PREROUTING (policy ACCEPT)
num target prot opt source destination
1 DIVERT tcp -- 0.0.0.0/0 0.0.0.0/0 socket
2 TPROXY tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 TPROXY redirect 0.0.0.0:3129 mark 0x1/0x1

Chain INPUT (policy ACCEPT)
num target prot opt source destination

Chain FORWARD (policy ACCEPT)
num target prot opt source destination

Chain OUTPUT (policy ACCEPT)
num target prot opt source destination

Chain POSTROUTING (policy ACCEPT)
num target prot opt source destination

Chain DIVERT (1 references)
num target prot opt source destination
1 MARK all -- 0.0.0.0/0 0.0.0.0/0 MARK set 0x1
2 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0

Table: filter
Chain INPUT (policy ACCEPT)
num target prot opt source destination

Chain FORWARD (policy ACCEPT)
num target prot opt source destination

Chain OUTPUT (policy ACCEPT)
num target prot opt source destination

# ifconfig
eth0 Link encap:Ethernet HWaddr 00:21:5E:4D:CB:9A
          inet addr:172.27.5.104 Bcast:172.27.5.255 Mask:255.255.255.0
          inet6 addr: fe80::221:5eff:fe4d:cb9a/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
          RX packets:2116 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1289 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:243203 (237.5 KiB) TX bytes:219417 (214.2 KiB)
          Interrupt:16

eth1 Link encap:Ethernet HWaddr 00:21:5E:4D:CB:9B
          UP BROADCAST MULTICAST MTU:1500 Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)
          Interrupt:21

lo Link encap:Local Loopback
          inet addr:127.0.0.1 Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING MTU:16436 Metric:1
          RX packets:4 errors:0 dropped:0 overruns:0 frame:0
          TX packets:4 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:240 (240.0 b) TX bytes:240 (240.0 b)

# ping 0.0.0.0
PING 0.0.0.0 (127.0.0.1) 56(84) bytes of data.
64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.042 ms
64 bytes from 127.0.0.1: icmp_seq=2 ttl=64 time=0.012 ms
^C

In this configuration I can connect directly to 3128 using firefox and return webpages. Turning the proxy setting off in Firefox the browser hangs then times out.

From the client if I try to ping an address in the internet the ping hangs.
  
Any help would be gratefully received,
Damian.

--
Damian O'Neill, Director Software Solutions, BTI Systems, Belfast, UK