<html>
<head>
<base href="https://bugzilla.netfilter.org/" />
</head>
<body><span class="vcard"><a class="email" href="mailto:bazsi77@gmail.com" title="Balazs Scheidler <bazsi77@gmail.com>"> <span class="fn">Balazs Scheidler</span></a>
</span> changed
<a class="bz_bug_link
bz_status_NEW "
title="NEW - tproxy rule is not matched for ip6"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1398">bug 1398</a>
<br>
<table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>What</th>
<th>Removed</th>
<th>Added</th>
</tr>
<tr>
<td style="text-align:right;">CC</td>
<td>
</td>
<td>bazsi77@gmail.com
</td>
</tr></table>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW - tproxy rule is not matched for ip6"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1398#c1">Comment # 1</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW - tproxy rule is not matched for ip6"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1398">bug 1398</a>
from <span class="vcard"><a class="email" href="mailto:bazsi77@gmail.com" title="Balazs Scheidler <bazsi77@gmail.com>"> <span class="fn">Balazs Scheidler</span></a>
</span></b>
<pre>tproxy is not doing NAT, so it would only match in case there's an open socket
with IP_TRANSPARENT setsockopt set:
IP_TRANSPARENT (since Linux 2.6.24)
Setting this boolean option enables transparent proxying on
this socket. This socket option allows the calling application to bind to a
nonlocal IP address and operate
both as a client and a server with the foreign address as the
local endpoint. NOTE: this requires that routing be set up in a way that
packets going to the foreign
address are routed through the TProxy box (i.e., the system
hosting the application that employs the IP_TRANSPARENT socket option).
Enabling this socket option requires
superuser privileges (the CAP_NET_ADMIN capability).
TProxy redirection with the iptables TPROXY target also requires
that this option be set on the redirected socket.
If either the socket is not found or the flag is not set, it will just break
out
from the evaluation, thus the counters will not be processed.
quoting net/netfilter/nft_tproxy.c:
if (sk && nf_tproxy_sk_is_transparent(sk))
nf_tproxy_assign_sock(skb, sk);
else
regs->verdict.code = NFT_BREAK;
This might be a bit unintuitive as this is actually an "error" condition which
is not reported in any way:
the rule to be processed successfully needs the userspace daemon to be running.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>