Hi,

we would like to use stunnel in transpartent mode. Therefore we already applied iptable changes as mentioned in the man page :

Re-write address to appear as if wrapped daemon is connecting from the SSL client machine instead of the machine running stunnel.

           This option is currently available in:

               remote mode (I<connect> option) on Linux >=2.6.28

           Linux >=2.6.28 requires the following setup for iptables and routing (possibly in /etc/rc.local or equivalent file):

               iptables -t mangle -N DIVERT

               iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT

               iptables -t mangle -A DIVERT -j MARK --set-mark 1

               iptables -t mangle -A DIVERT -j ACCEPT

               ip rule add fwmark 1 lookup 100

               ip route add local 0.0.0.0/0 dev lo table 100

However the connection to the services cannot be established and we run into a timeout.

2015.02.09 10:00:03 LOG7[6658:139940568909760]: ldaps-in accepted FD=12 from xxxxxx:51018

2015.02.09 10:00:03 LOG7[6658:139940568905472]: ldaps-in started

2015.02.09 10:00:03 LOG7[6658:139940568905472]: FD 12 in non-blocking mode

2015.02.09 10:00:03 LOG7[6658:139940568905472]: Waiting for a libwrap process

2015.02.09 10:00:03 LOG7[6658:139940568905472]: Acquired libwrap process #0

2015.02.09 10:00:03 LOG7[6658:139940568905472]: Releasing libwrap process #0

2015.02.09 10:00:03 LOG7[6658:139940568905472]: Released libwrap process #0

2015.02.09 10:00:03 LOG7[6658:139940568905472]: ldaps-in permitted by libwrap from xxxxxxx:51018

2015.02.09 10:00:03 LOG5[6658:139940568905472]: ldaps-in accepted connection from xxxxxxx:51018

2015.02.09 10:00:03 LOG7[6658:139940568905472]: SSL state (accept): before/accept initialization

2015.02.09 10:00:03 LOG7[6658:139940568905472]: SSL state (accept): SSLv3 read client hello A

2015.02.09 10:00:03 LOG7[6658:139940568905472]: SSL state (accept): SSLv3 write server hello A

2015.02.09 10:00:03 LOG7[6658:139940568905472]: SSL state (accept): SSLv3 write certificate A

2015.02.09 10:00:03 LOG7[6658:139940568905472]: SSL state (accept): SSLv3 write server done A

2015.02.09 10:00:03 LOG7[6658:139940568905472]: SSL state (accept): SSLv3 flush data

2015.02.09 10:00:03 LOG7[6658:139940568905472]: SSL state (accept): SSLv3 read client key exchange A

2015.02.09 10:00:03 LOG7[6658:139940568905472]: SSL state (accept): SSLv3 read finished A

2015.02.09 10:00:03 LOG7[6658:139940568905472]: SSL state (accept): SSLv3 write change cipher spec A

2015.02.09 10:00:03 LOG7[6658:139940568905472]: SSL state (accept): SSLv3 write finished A

2015.02.09 10:00:03 LOG7[6658:139940568905472]: SSL state (accept): SSLv3 flush data

2015.02.09 10:00:03 LOG7[6658:139940568905472]:    1 items in the session cache

2015.02.09 10:00:03 LOG7[6658:139940568905472]:    0 client connects (SSL_connect())

2015.02.09 10:00:03 LOG7[6658:139940568905472]:    0 client connects that finished

2015.02.09 10:00:03 LOG7[6658:139940568905472]:    0 client renegotiations requested

2015.02.09 10:00:03 LOG7[6658:139940568905472]:    1 server connects (SSL_accept())

2015.02.09 10:00:03 LOG7[6658:139940568905472]:    1 server connects that finished

2015.02.09 10:00:03 LOG7[6658:139940568905472]:    0 server renegotiations requested

2015.02.09 10:00:03 LOG7[6658:139940568905472]:    0 session cache hits

2015.02.09 10:00:03 LOG7[6658:139940568905472]:    0 external session cache hits

2015.02.09 10:00:03 LOG7[6658:139940568905472]:    0 session cache misses

2015.02.09 10:00:03 LOG7[6658:139940568905472]:    0 session cache timeouts

2015.02.09 10:00:03 LOG6[6658:139940568905472]: SSL accepted: new session negotiated

2015.02.09 10:00:03 LOG6[6658:139940568905472]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1

2015.02.09 10:00:03 LOG7[6658:139940568905472]: FD 13 in non-blocking mode

2015.02.09 10:00:03 LOG6[6658:139940568905472]: local_bind succeeded on the original port

2015.02.09 10:00:03 LOG6[6658:139940568905472]: connect_blocking: connecting 127.0.0.1:10389

2015.02.09 10:00:03 LOG7[6658:139940568905472]: connect_blocking: s_poll_wait 127.0.0.1:10389: waiting 10 seconds

2015.02.09 10:00:13 LOG3[6658:139940568905472]: connect_blocking: s_poll_wait 127.0.0.1:10389: timeout

2015.02.09 10:00:13 LOG5[6658:139940568905472]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket

2015.02.09 10:00:13 LOG7[6658:139940568905472]: ldaps-in finished (0 left)

Any idea why the timeout is occuring?

Best regards,

Shushant