TPROXY

requirements

1. latest kernel linux-2.6.18 here

2. tproxy patch for kernel 2.6.18 from here

3. iptables version 1.3.8 from netfilter

4. a pack of cigaretes and a cup of capucinno

5. squid 2.6.STABLE18 from squid-cache.org

Recompile your kernel…..

cd /usr/src

tar -jxvf <your-path-dir>/linux-2.6.18.6.tar.bz2

patch your kernel with tproxy support

tar -zxvf /<path-your-dir>/cttproxy-2.6.18-2.0.6.tar.gz

cd linux-2.6.18.4/

cat /usr/src/cttproxy-2.6.18-2.0.6/patch_tree/01-nat_reservations.patch | patch -p1

cat /usr/src/cttproxy-2.6.18-2.0.6/patch_tree/02-tproxy.patch | patch -p1

cat /usr/src/cttproxy-2.6.18-2.0.6/patch_tree/03-nat_delete.patch | patch -p1

make clean && make mrproper

make menuconfig or make config

under networking –> netowrking options –> netfilter configuration

CONFIG_IP_NF_TPROXY=m
CONFIG_IP_NF_MATCH_TPROXY=m
CONFIG_IP_NF_TARGET_TPROXY=m

contact me for complete .config

make && make install && make modules_install

cp arch/i386/boot/bzImage /boot/System.map-2.6.18

re-write your lilo.conf to load new kernel image at boot time

reload your lilo

reboot your server

—————————————————————————————

patching your iptables….

cd /usr/src

tar -jxvf /<your-path-dir>/iptables-1.3.8.tar.bz2

cd iptables-1.3.8/

cat /usr/src/cttproxy-2.6.18-2.0.6/iptables/iptables-1.3-cttproxy.diff | patch -p1

make KERNEL_DIR=/usr/src/linux-2.6.18/

make install KERNEL_DIR=/usr/src/linux-2.6.18/

make install-devel (optional)

modprobe ipt_tproxy

modprobe iptable_tproxy

if you don’t get any error, you got it!!!

————————————————————————————–

installing squid………….

cd /usr/src/

tar -jxvf /<your-path-dir>/squid-2.6.STABLE18.tar.bz2

cd squid-2.6.STABLE18

./configure ‘–prefix=/usr/local/squid’ ‘–sysconfdir=/etc/squid’ ‘–bindir=/usr/bin’ ‘–sbindir=/usr/sbin’ ‘–enable-FEATURE=yes’ ‘–enable-storeio=ufs,diskd,null’ ‘–enable-icmp’ ‘–enable-delay-pools’ ‘–enable-icap-client’ ‘–enable-kill-parent-hack’ ‘–enable-cachemgr-hostname=indomeya.net.id’ ‘–enable-arp-acl’ ‘–enable-ssl’ ‘–enable-cache-digests’ ‘–enable-x-accelerator-vary’ ‘–enable-stacktraces’ ‘–enable-cpu-profiling’ ‘–with-PACKAGE=yes’ ‘–enable-dependency-tracking’ ‘–enable-gnuregex’ ‘–enable-xmalloc-statistics’ ‘–enable-removal-policies=lru’ ‘–enable-useragent-log’ ‘–enable-referer-log’ ‘–enable-forw-via-db’ ‘–enable-default-hostsfile=/etc/hosts’ ‘–enable-ntlm-fail-open’ ‘–with-pic’ ‘–with-pthreads’ ‘-with-aio’ ‘–with-dl’ ‘–with-large-files’ ‘–enable-http-violations’ ‘–enable-underscores’ ‘–enable-linux-tproxy’ ‘–enable-linux-netfilter’ ‘–enable-htcp’ ‘–enable-leakfinder’ ‘–enable-follow-x-forwarded-for’

at this configure option will put squid.conf at /etc/squid/…

——————————————————————————————

write your squid.conf with your own imagination or contact me if you want to use my squid.conf. All of squid.conf reference is available here.

——————————————————————————————

Make sure you’ve change all permission on proxy cache directory when needed and run your squid as a daemon.

put this iptables command to your iptables init script

iptables -t tproxy -A PREROUTING -s xxx.xxx.xxx.xxx/24 -p tcp -m tcp –dport 80 -j TPROXY –on-port 3128 –on-ip 0.0.0.0

correct me if i’m wrong………

Advertisement

10 Comments

Comments RSS TrackBack Identifier URI