Re: How to use TROXY target only for specific outgoing interface

[Sebastian Poehn <sebastian.poehn@googlemail.com>]

Thanks Eliezer. You are right. Creating a ipset containing all routes is
the only thing you can do in PREROUTING. As this solution is not useable
for me, I ended up writing a small piece of code taking a packet from
NFQUEUE and performing a nexthop lookup and outgoing if and accordingly
setting a fwmark.

-m mark --mark LOCAL -j CONNMARK --set-mark LOCAL
-m mark --mark WIDE -j CONNMARK --set-mark WIDE
-m connmark --mark LOCAL -j ACCEPT
-m connmark --mark WIDE -j TPROXY
-m TPROXYTRAFFIC -j NFQUEUE

Notice the usage of connmark so only one lookup is needed for a stream. 

On Tue, 2013-01-15 at 14:02 +0200, Eliezer Croitoru wrote:
> On 1/14/2013 9:12 PM, Sebastian Poehn wrote:
> > I've drawn a new picture. We want to connect from Node 1 to the 'internet'. All traffic via wan1 shall be proxied, traffic over lan1 not.
> >
> > The only valid match for this situation is the outgoing interface ( oif == wan1 do proxy, else no proxy). It is not possible to match for
> > dst networks, as routing metrics may change and so even the use of wan1 or wan2 (for the uplink).
> >
> > I can not -A POSTROUTING -o wan1 -j TPROXY as TPROXY must be called in PREROUTING (there -o is not present).
> >
> >                 internet
> >    ____________________________________
> >     A                              A
> >     |wan1                          |wan2
> >     |                              |
> > #########      #########      #########
> > #ROUTER1# lan1 #ROUTER2# lan3 #ROUTER3#
> > #   +   #<---->#       #<---->#       #
> > #TPROXY #  igp #       # igp  #       #
> > #########      #########      #########
> >     |
> >     | lan2
> >     |
> > #########
> > # NODE 1#
> > #       #
> > #       #
> > #########
> >
> >
> Hey there,
> 
> Thanks for the new picture.
> I understand what is your problem since it's a very common concept.
> But you must understand that most of TPROXY systems are very static.
> 
> Take a deep breath and accept(like a server\socket) that the connections 
> can be intercepted only in a prerouting table.
> what I do suggest you is to use a synamic ipset to allow you this 
> specific thing you need.
> 
> Since you can only use ip addresses as a match in the prerouting or an 
> incoming interface.
> Your problem is that you are using IGP which limits you to a specific 
> protocol which I think BIRD or QUAGGA doesn't work with.
> 
> What you can do if it was another protocol is to run a cron task every 
> once in a while to make sure the routing tables are still the same or 
> not and in a case of change to update an ipset that you will use to 
> either bypass or intercept the traffic into.
> 
> If you are working with ROUTING protocols it should be simple to know 
> what traffic is being routed to WAN1.
> 
> Best regards,
> Eliezer
>