ziti-tunnel tproxy: intercept locally generated packets without using local routes about ziti HOT 5 OPEN

Hi Ali,

Thanks for checking out Ziti!

I wrote this issue after one of the network engineers that I work with told me about custom routing tables. Some time after I created this issue I experimented with the technique, and like you I was still unable to send locally generated packets to a listener without relying on local routes.

My notes on the attempted setup:

ip route add default dev lo table 7
ip rule add fwmark 2 table 7
iptables -I OUTPUT -p tcp --dport 8080 -j MARK --set-mark 2
iptables -t mangle -I NF-INTERCEPT -p tcp --dport 8080 -j TPROXY --tproxy-mark 0x1/0x1 --on-ip=127.0.0.1 --on-port=37913

That's as far as I got before getting pulled back into other things. If memory serves I wasn't seeing the mark on the outbound packets, but I would need to get back into this to be sure. I hope to explore this solution again eventually, but for now it's on the back-burner.

from ziti.

Yes, local routes are necessary if locally generated packets need to be intercepted. The routes are not needed if the tunneler only intercepts packets that are received from other hosts (i.e. the tunneler is acting as a gateway).

The routes are needed because locally generated packets would otherwise not traverse the mangle table or the PREROUTING chain, which is the only place where the TPROXY iptables target is valid.

from ziti.

Hi Shawn,

Would you please explain more about this approach. I tried following method to route locally generated traffic to the local proxy but I did not succeed.

iptables -t filter -N MYPROXY
iptables -t filter -I OUTPUT -p tcp --dport 8080 -j MYPROXY
iptables -t filter -A MYPROXY -j MARK --set-mark 1
iptables -t filter -A MYPROXY -j ACCEPT

ip rule add fwmark 1 lookup 100
ip route add local 0.0.0.0/0 dev lo table 100

iptables -t mangle -A PREROUTING -p tcp --dport 8080 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 8888

from ziti.

Am I mistaken? I'm under the impression that ziti router's tunnel mode tproxy does use iptables tproxy marks, not IP routes. If that's correct, then it's one of the distinguishing differences between ziti-edge-tunnel's IP route approach, which requires elevated privs at the host level, and ziti router (and ziti tunnel) namespace'd approach with TPROXY, which happens to work in containers, and is therefore the only existing solution for pod-level transparent interception in Kubernetes.

For reference, I'm maintaining a comparison of the capabilities of both in this doc issue: openziti/ziti-doc#383

from ziti.

That makes sense and thank you for explaining it!

from ziti.