Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

transparent proxy: use IP_BINDANY where available #316

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

dlundquist
Copy link
Owner

This should add transparent proxy support for FreeBSD. I've tested this builds on FreeBSD 12.0, but I'm not sure if there are similar firewall considerations as there in on Linux:

# Setup a test network using network namespaces with the ns-test-proxy
# namespace configured like a normal transparent proxy box.
#
# +-----------------------------------------------------------+
# | Host (default) Network Namespace |
# | |
# | Route 192.0.2.4/30 via 192.0.2.1 dev veth-srv-proxy |
# | |
# | TestHTTPD process o veth-srv-proxy |
# | | 192.0.2.2/30 |
# | +-----------------------------------|---------------+ |
# | | SNIproxy Network Namespace | | |
# | | ns-test-proxy o veth-proxy-srv| |
# | | 192.0.2.1/30 | |
# | | IP Forwarding enabled | |
# | | IPTables and ip rules configured (see below) | |
# | | | |
# | | o veth-proxy-clt| |
# | | sniproxy process | 192.0.2.5/30 | |
# | | | | |
# | +-----------------------------------|---------------+ |
# | | |
# | +-----------------------------------|---------------+ |
# | | Client Network Namespace | veth-clt-proxy| |
# | | ns-test-clt o 192.0.2.6/30 | |
# | | | |
# | | Route default via 192.0.2.5 dev veth-clt-proxy | |
# | | | |
# | | curl process | |
# | | | |
# | +---------------------------------------------------+ |
# | |
# +-----------------------------------------------------------+
#
# IPTables NAT rules:
# Chain POSTROUTING (policy ACCEPT)
# target prot opt source destination
# MASQUERADE all -- 0.0.0.0/0 0.0.0.0/0
#
# IPTables Mangle rules:
# Chain PREROUTING (policy ACCEPT)
# target prot opt source destination
# DIVERT tcp -- 0.0.0.0/0 0.0.0.0/0 socket
#
# Chain DIVERT (1 references)
# target prot opt source destination
# MARK all -- 0.0.0.0/0 0.0.0.0/0 MARK set 0x1
# ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
#
# IP rules:
# 0: from all lookup local
# 32765: from all fwmark 0x1 lookup 100
# 32766: from all lookup main
# 32767: from all lookup default
#
# IP route table 100:
# local default dev lo scope host
. If someone wants to make transparent_proxy_test work on FreeBSD too that would be great.

See issue #315.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant