Hi,
I'm trying to setup yet another service of this kind. I've seen this has
been largely discussed several times on this list (but without valid
solutions), and I'm writting this email as some kind of last resort
after hours of testing and debugging.
Pretty simple configuration:
# cat /etc/stunnel/stunnel.conf
cert = /etc/ssl/certs/stunnel4/my-cert.crt
key = /etc/ssl/certs/stunnel4/my-cert.key
sslVersion = SSLv3
foreground = yes
pid = /tmp/stunnel4.pid
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
debug = 7
output = /var/log/stunnel.log
[service]
accept = 195.78.X.X:6697
connect = 195.78.X.X:1357
transparent = source
Accept and connect IP's are the same.
# /usr/local/bin/stunnel -version
stunnel 4.56 on i686-pc-linux-gnu platform
Compiled/running with OpenSSL 0.9.8o 01 Jun 2010
Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP
Global options:
debug = daemon.notice
pid = /usr/local/var/run/stunnel/stunnel.pid
RNDbytes = 64
RNDfile = /dev/urandom
RNDoverwrite = yes
Service-level options:
ciphers = ALL:!SSLv2:!aNULL:!EXP:!LOW:-MEDIUM:RC4:+HIGH
curve = prime256v1
sessionCacheSize = 1000
sessionCacheTimeout = 300 seconds
sslVersion = TLSv1 for client, all for server
stack = 65536 bytes
TIMEOUTbusy = 300 seconds
TIMEOUTclose = 60 seconds
TIMEOUTconnect = 10 seconds
TIMEOUTidle = 43200 seconds
verify = none
# /usr/local/bin/stunnel -sockets
stunnel 4.56 on i686-pc-linux-gnu platform
Compiled/running with OpenSSL 0.9.8o 01 Jun 2010
Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP
Socket option defaults:
Option Name | Accept | Local | Remote |OS default
----------------+----------+----------+----------+----------
SO_DEBUG | -- | -- | -- | no
SO_DONTROUTE | -- | -- | -- | no
SO_KEEPALIVE | -- | -- | -- | no
SO_LINGER | -- | -- | -- | 0:0
SO_OOBINLINE | -- | -- | -- | no
SO_RCVBUF | -- | -- | -- | 87380
SO_SNDBUF | -- | -- | -- | 65536
SO_RCVLOWAT | -- | -- | -- | 1
SO_SNDLOWAT | -- | -- | -- | 1
SO_RCVTIMEO | -- | -- | -- | 0:0
SO_SNDTIMEO | -- | -- | -- | 0:0
SO_REUSEADDR | yes| -- | -- | no
SO_BINDTODEVICE | -- | -- | -- |write-only
TCP_KEEPCNT | -- | -- | -- | 9
TCP_KEEPIDLE | -- | -- | -- | 7200
TCP_KEEPINTVL | -- | -- | -- | 75
IP_TOS | -- | -- | -- | 0
IP_TTL | -- | -- | -- | 64
TCP_NODELAY | -- | yes| yes| no
IP_FREEBIND | -- | -- | -- | no
And the timeout, the same I've seen suffering to other people:
2013.08.03 19:52:12 LOG7[18496:3074533056]: Service [service] accepted
(FD=3) from MY_HOME_ADDRESS:34836
2013.08.03 19:52:12 LOG7[18496:3074530160]: Service [service] started
2013.08.03 19:52:12 LOG5[18496:3074530160]: Service [service] accepted
connection from MY_HOME_ADDRESS:34836
(blah blah ssl stuff)
2013.08.03 19:52:12 LOG6[18496:3074530160]: Negotiated TLSv1/SSLv3
ciphersuite: DHE-RSA-AES256-SHA (256-bit encryption)
2013.08.03 19:52:12 LOG6[18496:3074530160]: Compression: null,
expansion: null
2013.08.03 19:52:12 LOG6[18496:3074530160]: IP_TRANSPARENT socket option set
2013.08.03 19:52:12 LOG6[18496:3074530160]: local_bind succeeded on the
original port
2013.08.03 19:52:12 LOG6[18496:3074530160]: connect_blocking: connecting
195.78.X.X:1357
2013.08.03 19:52:12 LOG7[18496:3074530160]: connect_blocking:
s_poll_wait 195.78.X.X:1357: waiting 60 seconds
2013.08.03 19:52:21 LOG3[18496:3074530160]: connect_blocking: connect
195.78.X.X:1357: Connection timed out (110)
2013.08.03 19:52:21 LOG5[18496:3074530160]: Connection reset: 0 byte(s)
sent to SSL, 0 byte(s) sent to socket
iptables stuff and that, is in place:
# cat /proc/sys/net/ipv4/conf/all/rp_filter
0
# cat /proc/sys/net/ipv4/ip_forward
1
And did the iptables part:
iptables -t mangle -N DIVERT
iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT
iptables -t mangle -A DIVERT -j MARK --set-mark 1
iptables -t mangle -A DIVERT -j ACCEPT
ip rule add fwmark 1 lookup 100
ip route add local 0.0.0.0/0 dev lo table 100
Debugging the whole thing, it can be seen that stunnel tries to connect:
[pid 16823] connect(9, {sa_family=AF_INET, sin_port=htons(1357),
sin_addr=inet_addr("195.78.X.X")}, 16) = -1 EINPROGRESS (Operation now
in progress)
BUT the service running in 1357 does this:
# tcpdump -i eth1 -n port 1357
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth1, link-type EN10MB (Ethernet), capture size 65535 bytes
19:52:52.586773 IP 195.78.X.X.1357 > MY_HOME_ADDRESS.34853: Flags [S.],
seq 2655966098, ack 546202865, win 5840, options [mss
1460,nop,nop,sackOK], length 0
And, according to that, it looks obvious to me that this setup will
never work, since that ACK packet goes to my home box, and not to the
local connection.
So either I'm doing something wrong (I hope I am!!) or this thing
definitely doesn't work...
Any help/ideas/whatever, please?
Thanks,
Rubén.
