third-party-mirrors/sslh
1
0
Fork 0
mirror of https://github.com/yrutschle/sslh.git synced 2025-04-18 17:57:39 +03:00
Code Issues Packages Projects Releases Wiki Activity

Update tproxy.md

Browse Source 
Minor formatting changes. Could also update tproxy.jpg to the svg version.
This commit is contained in:
FlexMcMurphy 2019-06-30 12:28:53 +01:00 committed by GitHub
parent fde86a778d
commit 08a64e99b4
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 36 additions and 39 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

75
doc/tproxy.md
View File

@ -2,22 +2,21 @@
============================== ==============================
Tutorial by Sean Warner. 19 June 2019 20:35 Tutorial by Sean Warner. 19 June 2019 20:35
 
Aim Aim
--- ---
* Here is my guide… the solution here only works for my very specific use-case but hopefully others can adapt it to suits their needs. * Show that `sslh` can transparently proxy requests from the internet to services on two separate hosts that are both on the same LAN.
* Show that SSLH can transparently proxy requests from the internet to services on two separate hosts that are both on the same LAN.
* The IP address of the client initiating the request is what the destination should see… and not the IP address of the host that `sslh` is running on, which is what happens when `sslh` is not running in transparent mode. * The IP address of the client initiating the request is what the destination should see… and not the IP address of the host that `sslh` is running on, which is what happens when `sslh` is not running in transparent mode.
  * The solution here only works for my very specific use-case but hopefully others can adapt it to suits their needs.
Overview of my Network Overview of my Network
---------------------- ----------------------
Two Raspberry Pis on my home LAN: Two Raspberry Pis on my home LAN:
* Pi A: 192.168.1.124 – `sslh` (Port 4433), Apache2 web server for https (port 443), `stunnel` (port 4480) to decrypt ssh traffic and forward to SSH server (also on Pi A at Port 1022) * Pi A: 192.168.1.124 – `sslh` (Port 4433), Apache2 web server for https (port 443), `stunnel` (port 4480) to decrypt ssh traffic and forward to SSH server (also on Pi A at Port 1022)
* Pi B: 192.168.1.123 - HTTP server (port 8000), SSH server (port 1022 on PiB). * Pi B: 192.168.1.123 - HTTP server (port 8000), SSH server (port 1022 on PiB).
  * I send traffic from the internet to my router's external port 443 then use a port forward rule in my router to map that to internal port 4433 where sslh is listening.
I send traffic from the internet to my router's external port 443 then use a port forward rule in my router to map that to internal port 4433 where sslh is listening.
![Architecture](tproxy.jpg) ![Architecture](tproxy.jpg)
@ -34,15 +33,15 @@ I compiled sslh from sources giving the binary pretty much all possible options
VERSION=$(shell ./genver.sh -r) VERSION=$(shell ./genver.sh -r)
ENABLE_REGEX=1         # Enable regex probes ENABLE_REGEX=1         # Enable regex probes
USELIBCONFIG=1         # Use libconfig? (necessary to use configuration files) USELIBCONFIG=1         # Use libconfig? (necessary to use configuration files)
USELIBPCRE=1         # Use libpcre? (needed for regex on musl) USELIBPCRE=1 # Use libpcre? (needed for regex on musl)
USELIBWRAP=1         # Use libwrap? USELIBWRAP=1         # Use libwrap?
USELIBCAP=1         # Use libcap? USELIBCAP=1         # Use libcap?
USESYSTEMD=1         # Make use of systemd socket activation USESYSTEMD=1         # Make use of systemd socket activation
COV_TEST=         # Perform test coverage? COV_TEST=         # Perform test coverage?
PREFIX=/usr/local PREFIX=/usr/local
BINDIR=$(PREFIX)/sbin BINDIR=$(PREFIX)/sbin
MANDIR=$(PREFIX)/share/man/man8 MANDIR=$(PREFIX)/share/man/man8
MAN=sslh.8.gz         # man page name MAN=sslh.8.gz         # man page name
# End of configuration -- the rest should take care of # End of configuration -- the rest should take care of
# itself # itself
@ -152,33 +151,33 @@ connect = 192.168.1.124:1022
TIMEOUTclose = 0 TIMEOUTclose = 0
``` ```
   
Configure iptables for piA Configure iptables for Pi A
-------------------------- --------------------------
The `_add.sh` script creates the rules, the `_rm.sh` script removes the rules. The `_add.sh` script creates the rules, the `_rm.sh` script removes the rules.
They will be lost if you reboot but there are ways to make them load again on start-up.. They will be lost if you reboot but there are ways to make them load again on start-up..
``` ```
# nano /usr/local/sbin/[filename.sh] # nano /usr/local/sbin/piA_tproxy_add.sh
``` ```
`piA_tproxy_add.sh`:
``` piA_tproxy_add.sh ``` piA_tproxy_add.sh
iptables -w -t mangle -N SSLH iptables -t mangle -N SSLH
iptables -w -t mangle -A PREROUTING -p tcp -m socket --transparent -j SSLH iptables -t mangle -A PREROUTING -p tcp -m socket --transparent -j SSLH
iptables -w -t mangle -A OUTPUT --protocol tcp --out-interface eth0 -m multiport --sport 443,4480 --jump SSLH iptables -t mangle -A OUTPUT --protocol tcp --out-interface eth0 -m multiport --sport 443,4480 --jump SSLH
iptables -w -t mangle -A SSLH --jump MARK --set-mark 0x1 iptables -t mangle -A SSLH --jump MARK --set-mark 0x1
iptables -w -t mangle -A SSLH --jump ACCEPT iptables -t mangle -A SSLH --jump ACCEPT
ip rule add fwmark 0x1 lookup 100 ip rule add fwmark 0x1 lookup 100
ip route add local 0.0.0.0/0 dev lo table 100 ip route add local 0.0.0.0/0 dev lo table 100
``` ```
`piA_tproxy_rm.sh`: ```
# nano /usr/local/sbin/piA_tproxy_rm.sh
```
``` piA_tproxy_rm.sh ``` piA_tproxy_rm.sh
iptables -w -t mangle -D PREROUTING -p tcp -m socket --transparent -j SSLH iptables -t mangle -D PREROUTING -p tcp -m socket --transparent -j SSLH
iptables -w -t mangle -D OUTPUT --protocol tcp --out-interface eth0 -m multiport --sport 443,4480 --jump SSLH iptables -t mangle -D OUTPUT --protocol tcp --out-interface eth0 -m multiport --sport 443,4480 --jump SSLH
iptables -w -t mangle -D SSLH --jump MARK --set-mark 0x1 iptables -t mangle -D SSLH --jump MARK --set-mark 0x1
iptables -w -t mangle -D SSLH --jump ACCEPT iptables -t mangle -D SSLH --jump ACCEPT
iptables -w -t mangle -X SSLH iptables -t mangle -X SSLH
ip rule del fwmark 0x1 lookup 100 ip rule del fwmark 0x1 lookup 100
ip route del local 0.0.0.0/0 dev lo table 100 ip route del local 0.0.0.0/0 dev lo table 100
``` ```
@ -195,15 +194,13 @@ Now run the "add" script on Pi A!
# piA_tproxy_rm.sh # piA_tproxy_rm.sh
``` ```
Configure iptables for piB Configure iptables for Pi B
-------------------------- --------------------------
``` ```
# nano /usr/local/sbin/[filename.sh] # nano /usr/local/sbin/piB_tproxy_add.sh
```
piB_tproxy_add.sh
``` ```
``` piB_tproxy_add.sh
iptables -t mangle -N SSLHSSL iptables -t mangle -N SSLHSSL
iptables -t mangle -A OUTPUT -o eth0 -p tcp -m multiport --sport 1022,8000 -j SSLHSSL iptables -t mangle -A OUTPUT -o eth0 -p tcp -m multiport --sport 1022,8000 -j SSLHSSL
iptables -t mangle -A SSLHSSL --jump MARK --set-mark 0x1 iptables -t mangle -A SSLHSSL --jump MARK --set-mark 0x1
@ -213,7 +210,9 @@ ip route add default via 192.168.1.124 table 100
ip route flush cache ip route flush cache
``` ```
piB_tproxy_add.sh ```
# nano /usr/local/sbin/piB_tproxy_rm.sh
```
``` ```
iptables -t mangle -D OUTPUT -o eth0 -p tcp -m multiport --sport 1022,8000 -j SSLHSSL iptables -t mangle -D OUTPUT -o eth0 -p tcp -m multiport --sport 1022,8000 -j SSLHSSL
iptables -t mangle -D SSLHSSL --jump MARK --set-mark 0x1 iptables -t mangle -D SSLHSSL --jump MARK --set-mark 0x1
@ -238,7 +237,6 @@ Now run the "add" script on Pi B!
   
Testing Testing
------- -------
 
* Getting to sshd on PiA * Getting to sshd on PiA
I did this test using 4G from my phone (outside the LAN) I did this test using 4G from my phone (outside the LAN)
@ -251,25 +249,24 @@ I execute this command from a terminal window..
``` ```
# proxytunnel -v -e -C root.pem -p 78.141.192.198:8080 -d ssh.example.com:443 # proxytunnel -v -e -C root.pem -p 78.141.192.198:8080 -d ssh.example.com:443
``` ```
 
* Getting to sshd on PiB * Getting to sshd on PiB
I did this test using 4G from my phone (outside the LAN) I did this test using 4G from my phone (outside the LAN)
My smartphone telecom provider blocks ssh over port 443 so I need to use `proxytunnel` to encrypt. My smartphone telecom provider blocks ssh over port 443 so I need to use `proxytunnel` to encrypt.
Use the Proxytunnel `-X` switch to encrypt from local proxy to destination only so by the time we get to the destination it is unencrypted and `sslh` will see the ssh protocol and demultiplex to PiB as per `sslh.cfg`. Use the Proxytunnel `-X` switch to encrypt from local proxy to destination only so by the time we get to the destination it is unencrypted and `sslh` will see the ssh protocol and demultiplex to PiB as per `sslh.cfg`.
``` ```
# proxytunnel -v -X -C root.pem -p 78.141.192.198:8080 -d ssh.example.com:443 # proxytunnel -v -X -C root.pem -p 78.141.192.198:8080 -d ssh.example.com:443
``` ```
 
Now when you test it all look at the output in daemon.log like this: Now when you test it all look at the output in daemon.log like this:
``` ```
# grep -i 'ssl' /var/log/daemon.log # grep -i 'ssl' /var/log/daemon.log
``` ```
 
You should see that the IP address and port from the “connection from” and “forwarded from” fields are the same. You should see that the IP address and port from the “connection from” and “forwarded from” fields are the same.
 
Special thanks and appreciation to Michael Yelsukov without whom I would never have got this working. Special thanks and appreciation to Michael Yelsukov without whom I would never have got this working.
 
Any feedback or corrections very welcome! Any feedback or corrections very welcome!