Skip to content

Preparing Raspberry Pi for building additional kernel modules.

Preparing Raspberry Pi for building additional kernel modules. published on 1 Comment on Preparing Raspberry Pi for building additional kernel modules.

Today I was trying to build ipt-netflow kernel module on my Raspberry Pi with Raspbian linux. For hours I was stuck with proper system setup to make it ready for compiling additional kernel modules. The problem was with make prepare modules_prepare command which gives me such error:

Google was not very helpful with this problem. Finally, basing on various trops, I got it worked. Uff.. Here is the proper way to setup Raspberry Pi for compiling additional kernel modules:

Install kernel headers and other tools:

Install rpi-source tool. This downloading full kernel sources, not only kernel headers.

Install kernel sources (Lack of this was the cause of problems).

You will see something like that:

I suggest you create a symlink to /usr/src/linux:

Copy current kernel config to downloaded kernel sources and make oldconfig:

Run module assistant:

Prepare kernel for modules compilation:

After this steps I was able to compile third party kernel modules. 🙂
At the end I would like to highly recommend ipt-netflow kernel module – it is very robust solution for sending netflows from linux machines.

Transparent http proxy with Golang and tproxy

Transparent http proxy with Golang and tproxy published on 3 Comments on Transparent http proxy with Golang and tproxy

Recently I started interesting in Go language. First impressions of programming in Go are very good. In short brief, I like simplicity of this language, that you can not complicate the code too much. Goroutines and channels looks promising as solution for concurrency, and it seems simple to use. Static compiled binaries are easy to deploy. Performance is good.

I would like to share description and simple implementation in Go of fully transparent reverse or forward http proxy.

Go standard libraries – net/http and net/http/httputil provides everything needed to implement it.
Below the simplest implementation of http proxy:

Now, we can just set http proxy in browser and it will be working.

Transparent http proxy

But what if we want to to setup fully transparent proxy? For example: when we don’t want to configure manually browser on clients, but all outgoing http traffic should be pass by proxy for some reasons – logging, caching, make security scan for viruses etc. In this scenario transparent proxy is located between the client and the internet. Another use case of transparent http proxy is to set up it inline in communication between services in data center and performing some operations like traffic filtering, checking authorization etc.

System Configuration (routing table, tproxy)

I will describing scenario where http transparent proxy is acting on router which is the default gateway for my local network.
My network looks as follows:

Tproxy will be use to redirect traffic.
Tproxy allows as to redirect traffic designated to remote location to the local process.

From Linux 4.18 tproxy is included in nf_tables.

How tproxy works in details is described here:
https://www.kernel.org/doc/Documentation/networking/tproxy.txt
https://powerdns.org/tproxydoc/tproxy.md.html
https://people.netfilter.org/hidden/nfws/nfws-2008-tproxy_slides.pdf

Configuration of routing table and tproxy:

 

Http proxy in Go

I had to wait for Go 1.11 to be able to create custom socket with IP_TRANSPARENT param. From Go 1.11 there is possible to pass socket option before start listening or dialing. ListenConfig provide this.
https://go-review.googlesource.com/c/go/+/72810
https://golang.org/pkg/net/#ListenConfig

The key in implementation is to create custom listener for http.Serve and use LocalAddrContextKey to get destinetion address to which client want to connect. In fact address:port values from http.LocalAddrContextKey, are the values from local socket dynamicly created by tproxy.

Starting proxy:

Client from local network (192.168.1.6) is connecting to remote site on port 217.73.181.197:80. This connection is handled through the proxy.
Nestat is showing one very interesting thing:

Tproxy created tcp socket with remote site address (217.73.181.197:80) on my local machine. My router has only 192.168.1.1 and 37.247.61.7 addresses, routing table 100 does the job.
Go http proxy after receive request from client (192.168.1.6), made a connection to exactly the same address:port as it received. MAGIC! 🙂

Securing Asterisk SIP PBX by simple iptables rule checking if the domain is correct

Securing Asterisk SIP PBX by simple iptables rule checking if the domain is correct published on 14 Comments on Securing Asterisk SIP PBX by simple iptables rule checking if the domain is correct

Hi,

For some time I’ve been looking for a simple way to protect my Asterisk SIP pbx against attacks from bots, scanners which scans and trying dialing to premium numbers. Opening SIP port to the internet causes that there was no one minute without suspect requests hitting my Asterisk. The log was full of that attempts.

While analyzing this problem I noticed that bots, scanners, attackers using everywhere IP address of my server to trying break it. While my proper clients using domain of my Asterisk server. If user is using domain name in his SIP client/phone,this domain is used in further communication on SIP protocol.

Below I will show example of INVITE (INVITE is using to establish VoIP call) SIP request from user using domain name (sip.example.com), and from user using IP address (10.10.10.10) of Asterisk server.

With domain:

With IP address:

Knowing that, I want to block requests to Asterisk server which are NOT contains my domain name. In this point I want to clarify that I have special subdomain for telephones. Bots, scanners, attackers are not knowing about this domain.
Blocking unwanted requests can be done by iptables rules with string matching.

Differences between rules result from different approach between TCP and UDP protocols when establishing a connection. TCP need to do three way handshake to establish connection, UDP not doing this.

After applying these rules, I did not see even one attack 🙂
At the and we can check increasing iptables counters:

Strongswan IPsec on LEDE/OpenWRT with fast-classifier and shortcut-fe modules

Strongswan IPsec on LEDE/OpenWRT with fast-classifier and shortcut-fe modules published on 5 Comments on Strongswan IPsec on LEDE/OpenWRT with fast-classifier and shortcut-fe modules

I have using TP-Link TL-WDR4300 router with LEDE software. Recently, thanks to fast-classifier and shortcut-fe modules the router got a second life 🙂 To my surprise after loading fast-classifier modules it can be able to pass 500Mb/s over NAT, which is absolutely great result 🙂

But after that I noticed that my site-to-site IPsec tunnel, based on Strongswan stopped working properly… Ping was working, tcp connections over tunnel could be established, but after passing some tcp packets the connection freezes. I suspected a problem with MTU, but that was not it.
After unload kmod-fast-classifier and kmod-shortcut-fe tunnel was working properly. I’m started to reading source code of fast-classifier and shortcut-fe modules. I found that:

I realized that the offloading which is doing by fast-classifier and shortcut-fe is basing on conntrack table. The next thought was that conntrack is needed to realize NAT. Only connection between my LAN and internet (WAN) should be tracked and should be in conntrack table. I don’t need to track connection beetween my local nets connected through site-to-site vpn! Connections between my local nets can be realized only based on routing table. I decided to disable conntrack for my local nets and see if it solved my problem.
My network looks as follows:

Strongswan configuration: /etc/ipsec.conf (192.168.0.0/24)

Strongswan configuration: /etc/ipsec.conf (192.168.1.0/24)

File with secrets is the same on booth sides. /etc/ipsec.secrets

Excluding particular connections from conntrack can be done by iptables with raw and conntrack module – I had to install them earlier.

I excluded whole local network class – 192.168.0/0/12

Now my IPsec tunnel started passing traffic properly! 🙂 And there is no connections from my localnets in conntrack! (so fast-classifier not offloading this connections).
The only issue was that I was unable to connect to LEDE router (192.168.0.1) from my remote network behind IPsec tunnel. I resolved that by exclude IP of router from iptables rule:

I had to install iprange module before:

Now I can enjoy very fast internet connection with fast-classifier and fully working strongswan IPsec vpn connections 🙂