[résolu]proxy transparent impossibler de se connecter

Support Debian
#1

Salut,
bon voilà mon problème j’ai mi des règles iptables pour rediriger les requêtes du lan pour obliger a passer par le proxy 192.168.0.1:3128
(proxy transparent)

eth1 = carte WAN
eth2 = carte LAN

voici les règles que j’ai mi pour iptables, si vous voulez bien vérifier quelles sont justes car je n’arrive pas a me connecter via le lan mais bien via le serveur:

server:~# iptables -t nat -A PREROUTING -i eth2 -p tcp --dport 80 -j DNAT --to 192.168.0.1:3128 server:~# iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 3128
car je suis pas encore très a l’aise avec iptables.

voici mes règles en gros:

[code]sserver:~# iptables -L --line-numbers
Chain INPUT (policy DROP)
num target prot opt source destination
1 ACCEPT 0 – anywhere server.zone.teledisnet.be
2 ACCEPT 0 – anywhere anywhere
3 ACCEPT 0 – anywhere anywhere
4 ACCEPT tcp – anywhere anywhere
5 ACCEPT udp – anywhere anywhere
6 ACCEPT icmp – anywhere anywhere
7 ACCEPT tcp – anywhere anywhere tcp spts:1024:65535 dpt:ftp-data
8 ACCEPT tcp – anywhere anywhere tcp spts:1024:65535 dpt:ftp
9 ACCEPT tcp – anywhere anywhere tcp spts:1024:65535 dpt:www
10 DROP 0 – 198.0.0.255 anywhere
11 DROP 0 – anywhere 198.0.0.255
12 DROP 0 – default anywhere
13 DROP 0 – anywhere default
14 DROP 0 – 255.255.255.255 anywhere
15 DROP 0 – anywhere 255.255.255.255
16 log_and_drop 0 – anywhere anywhere
17 LOG 0 – anywhere anywhere LOG level emerg prefix `FW '
18 REJECT 0 – anywhere anywhere reject-with icmp-port-unreachable
19 DROP tcp – anywhere anywhere tcp dpt:telnet
20 ACCEPT icmp – anywhere anywhere icmp echo-request limit: avg 2/sec burst 5
21 DROP icmp – anywhere anywhere icmp echo-request
22 ACCEPT 0 – 192.168.0.0/24 server.zone.teledisnet.be
23 DROP udp – anywhere anywhere
24 DROP tcp – anywhere anywhere tcp flags:FIN,SYN,RST,ACK/SYN

Chain FORWARD (policy DROP)
num target prot opt source destination
1 ACCEPT 0 – 192.168.0.0/24 anywhere
2 ACCEPT 0 – anywhere anywhere
3 LOG tcp – anywhere anywhere tcp dpt:www flags:FIN,SYN,RST,ACK/SYN LOG level warning prefix `quelqu’un surf…’

Chain OUTPUT (policy DROP)
num target prot opt source destination
1 ACCEPT 0 – anywhere anywhere
2 ACCEPT 0 – anywhere anywhere
3 ACCEPT 0 – anywhere anywhere
4 ACCEPT tcp – anywhere anywhere
5 ACCEPT udp – anywhere anywhere
6 ACCEPT icmp – anywhere anywhere
7 ACCEPT 0 – anywhere anywhere
8 DROP 0 – 198.0.0.255 anywhere
9 DROP 0 – anywhere 198.0.0.255
10 DROP 0 – default anywhere
11 DROP 0 – anywhere default
12 DROP 0 – 255.255.255.255 anywhere
13 DROP 0 – anywhere 255.255.255.255

Chain log_and_drop (1 references)
num target prot opt source destination

[/code]

et voici ce que j’ai dans les logs de squid lorsque j’essai de me connecter via une machine du LAN:

server:~# tail -f /var/log/squid/access.log 1173356150.323 7 192.168.0.250 TCP_DENIED/400 1692 GET error:invalid-request - NONE/- text/html 1173356155.344 63 192.168.0.250 TCP_DENIED/400 1692 GET error:invalid-request - NONE/- text/html 1173356156.046 40 192.168.0.250 TCP_DENIED/400 1692 GET error:invalid-request - NONE/- text/html 1173356156.728 23 192.168.0.250 TCP_DENIED/400 1692 GET error:invalid-request - NONE/- text/html 1173356156.867 12 192.168.0.250 TCP_DENIED/400 1692 GET error:invalid-request - NONE/- text/html 1173356159.087 59 192.168.0.250 TCP_DENIED/400 1687 GET error:invalid-request - NONE/- text/html 1173356181.314 1 192.168.0.250 TCP_DENIED/400 1874 GET error:invalid-request - NONE/- text/html 1173356825.529 1 192.168.0.250 TCP_DENIED/400 1687 GET error:invalid-request - NONE/- text/html 1173356826.849 24 192.168.0.250 TCP_DENIED/400 1687 GET error:invalid-request - NONE/- text/html 1173356830.449 59 192.168.0.250 TCP_DENIED/400 1713 GET error:invalid-request - NONE/- text/html

#2

je remet ma requête car aparès un redémarrage je me suis rendu compte que le squid chevauchait le port 80 d’apache donc c’est une mauvaise idée.

Donc me revoilà avec mon problème d’impossibilité de me connecter sur le net a partir d’un client lan en passant par un proxy transparent.

Voici ce que j’ai via un tcpdump de la carte eth2 (LAN) lrosque j’essai de faire une requête via un client du lan:

server:~# tcpdump -i eth2 port 80 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth2, link-type EN10MB (Ethernet), capture size 96 bytes 17:26:36.928765 IP 192.168.0.250.1451 > nf-in-f99.google.com.www: S 552404971:552404971(0) win 16384 <mss 1460,nop,nop,sackOK> 17:26:36.928848 IP nf-in-f99.google.com.www > 192.168.0.250.1451: S 3706805402:3706805402(0) ack 552404972 win 5840 <mss 1460,nop,nop,sackOK> 17:26:36.929183 IP 192.168.0.250.1451 > nf-in-f99.google.com.www: . ack 1 win 17520 17:26:36.930043 IP 192.168.0.250.1451 > nf-in-f99.google.com.www: P 1:511(510) ack 1 win 17520 17:26:36.930096 IP nf-in-f99.google.com.www > 192.168.0.250.1451: . ack 511 win 6432 17:26:36.930648 IP nf-in-f99.google.com.www > 192.168.0.250.1451: . 1:1461(1460) ack 511 win 6432 17:26:36.930683 IP nf-in-f99.google.com.www > 192.168.0.250.1451: P 1461:1717(256) ack 511 win 6432 17:26:36.930936 IP nf-in-f99.google.com.www > 192.168.0.250.1451: F 1717:1717(0) ack 511 win 6432 17:26:36.932803 IP 192.168.0.250.1451 > nf-in-f99.google.com.www: . ack 1718 win 17520 17:26:36.933368 IP 192.168.0.250.1451 > nf-in-f99.google.com.www: F 511:511(0) ack 1718 win 17520 17:26:36.933394 IP nf-in-f99.google.com.www > 192.168.0.250.1451: . ack 512 win 6432

et su sur l’interface du WAN je ai ça:

server:~# tcpdump -i eth1 port 80 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth1, link-type EN10MB (Ethernet), capture size 96 bytes
donc les packets de passent pas a travers de l’interface WAN (eth1) externe lorsque je fais un requête via un client du LAN.

COmment rediriger les packets qui viennent de eth1 sur le port 3128 vers eth2 sur le port 80 ??

Voici ce que j’ai dans le syslog:

Mar 8 17:50:42 server kernel: audit(1173372642.490:15): dev=eth1 prom=0 old_prom=256 auid=4294967295 Mar 8 17:50:50 server kernel: eth2: Promiscuous mode enabled. Mar 8 17:50:50 server kernel: device eth2 entered promiscuous mode Mar 8 17:50:50 server kernel: audit(1173372650.915:16): dev=eth2 prom=256 old_prom=0 auid=4294967295 Mar 8 17:51:08 server squid[6934]: clientReadRequest: FD 16 (192.168.0.250:1081) Invalid Request Mar 8 17:53:09 server squid[6934]: clientReadRequest: FD 16 (192.168.0.250:1082) Invalid Request Mar 8 17:59:14 server squid[6934]: clientReadRequest: FD 16 (192.168.0.250:1083) Invalid Request Mar 8 17:59:15 server squid[6934]: clientReadRequest: FD 16 (192.168.0.250:1084) Invalid Request Mar 8 17:59:16 server squid[6934]: clientReadRequest: FD 16 (192.168.0.250:1085) Invalid Reques

#3

après redémarrage le fichier ip_forward se mettais encore à 0, j’ai du créer un script pour iptables.
ça roule.

#4

ip_forward peut se gèrer avec le fichier sysctl.conf (man sysctl, man sysctl.conf)

#5

c’est ce que j’ai fait mais appremment il se remet à 0 au reboot.