TPROY代理失败问题
首先描述我的做法：1.拓扑图
2.在防火墙上添加策略
iptables -t mangle -N DIVERT
iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT
iptables -t mangle -A DIVERT -j MARK --set-mark 1
iptables -t mangle -A DIVERT -j ACCEPT
ip rule add fwmark 1 lookup 100
ip route add local 0.0.0.0/0 dev lo table 100
iptables -t mangle -A PREROUTING -p tcp --dport 110 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 10110
3.在防火墙上启动一个server,代码如下：
int main (int argc, char **argv)
{
int s;
int c;
short int port;
struct sockaddr_in servaddr;
struct sockaddr_in clntaddr;
int n;
int ret;
struct msghdr msg;
char cntrlbuf;
struct iovec iov;
char *endptr;
if ((s = socket (AF_INET, SOCK_STREAM, 0)) < 0)
{
fprintf (stderr, "error creating listening socket.\n");
return -3;
}
n=1;
setsockopt(s, SOL_SOCKET, SO_REUSEADDR, &n, sizeof(n));
setsockopt(s, SOL_SOCKET, SO_BROADCAST, &n, sizeof(n));
/* Enable TPROXY IP preservation */
n=1;
ret = setsockopt (s, SOL_IP, IP_TRANSPARENT, &n, sizeof(int));
if (ret != 0)
{
fprintf (stderr, "error setting transparency for listening socket. err (#%d %s)\n", errno, strerror(errno));
close (s);
return -4;
}
memset (&servaddr, 0, sizeof (servaddr));
servaddr.sin_family = AF_INET;
servaddr.sin_addr.s_addr = htonl (INADDR_ANY);
servaddr.sin_port = htons (10110);
if (bind (s, (struct sockaddr *) &servaddr, sizeof (servaddr)) < 0)
{
fprintf (stderr, "error calling bind()\n");
return -6;
}
listen (s, 1024);
while (1)
{
n=sizeof(clntaddr);
if ((c = accept (s, (struct sockaddr *)&clntaddr, &n)) < 0)
{
fprintf (stderr, "error calling accept()\n");
break;
}
。。。。。。。。。。//handle(这个不是重点)
}
close (s);
return 0;
}
4.在192.168.221.95上配置一个foxmail用来收邮件pop3(110)，用自己的邮箱就行,比如说123@163.com
5.从外网给123@163.com发邮件
6.启动防火墙的server程序
7.在192.168.221.95上收邮件，但是防火墙的server程序没有收到连接，也就是说透明代理失败，数据包没有转到防火墙本地的10110端口？
8.有哪位大神知道原因？跟我联系qq:3030639229或者跟帖留言
中国这么多搞linux的就站出来一位大神，解决一下这个问题吧
页:
[1]