<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
Yes please, I would appreciate help with that script.
<div class=""><br class="">
</div>
<div class="">As I aforementioned, totally new to all this</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
<div class=""><br class="Apple-interchange-newline" style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
<span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><span><img height="38" width="45" apple-inline="yes" id="5D56D51A-C2EE-4C34-B098-F8BDD849A324" apple-width="yes" apple-height="yes" src="cid:2FD1C3AB-E45C-49F0-84AB-0F8AC658BD11@routerb408e2.com" class=""></span><em style="font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; color: rgb(0, 128, 0); font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 16px; background-color: rgb(255, 255, 255);" class=""><strong class="">Piensa
en el medio ambiente antes de imprimir este email.</strong></em> </span></div>
<br class="">
<div>
<blockquote type="cite" class="">
<div class="">On Dec 6, 2016, at 1:27 PM, Eliezer Croitoru <<a href="mailto:eliezer@ngtech.co.il" class="">eliezer@ngtech.co.il</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div class="">Now you can enhance the script by adding manually the ntop skype related networks based on:<br class="">
<a href="https://github.com/ntop/nDPI/blob/d9a2d9a6bd4d476d666d26cb713952760a975d92/src/lib/ndpi_content_match.c.inc#L286" class="">https://github.com/ntop/nDPI/blob/d9a2d9a6bd4d476d666d26cb713952760a975d92/src/lib/ndpi_content_match.c.inc#L286</a><br class="">
<br class="">
/*<br class="">
Skype (Microsoft CDN)<br class="">
157.56.135.64/26, 157.56.185.0/26, 157.56.52.0/26,<br class="">
157.56.53.128/25, 157.56.198.0/26<br class="">
157.60.0.0/16, 157.54.0.0/15 <br class="">
13.107.3.128/32<br class="">
13.107.3.129/32<br class="">
111.221.64.0 - 111.221.127.255<br class="">
91.190.216.0/21 (AS198015 Skype Communications Sarl)<br class="">
91.190.218.0/24<br class="">
40.126.129.109/32<br class="">
65.55.223.0/26<br class="">
*/<br class="">
<br class="">
If you need help scripting this let me know.<br class="">
<br class="">
Eliezer<br class="">
<br class="">
----<br class="">
http://ngtech.co.il/lmgtfy/<br class="">
Linux System Administrator<br class="">
Mobile: +972-5-28704261<br class="">
Email: eliezer@ngtech.co.il<br class="">
<br class="">
<br class="">
From: Sameh Onaissi [mailto:sameh.onaissi@solcv.com] <br class="">
Sent: Tuesday, December 6, 2016 7:29 PM<br class="">
To: Eliezer Croitoru <eliezer@ngtech.co.il><br class="">
Cc: Amos Jeffries <squid3@treenet.co.nz>; squid-users@lists.squid-cache.org<br class="">
Subject: Re: [squid-users] Skype for Business behind a transparent squid (TProxy) HTTP/S<br class="">
<br class="">
Hello, <br class="">
<br class="">
OK, I added the ssl_bump slice on the skype domains text file<br class="">
I installed ipset and ran the script.<br class="">
<br class="">
Now access.log has much less skype related logs:<br class="">
<br class="">
What is left is:<br class="">
1481044996.398 3412 10.0.0.11 TAG_NONE/200 0 CONNECT 132.245.1.32:443 - ORIGINAL_DST/132.245.1.32 -<br class="">
1481044996.423 0 10.0.0.11 TAG_NONE/400 3998 REGISTER sip:solcv.comSIP/2.0 - HIER_NONE/- text/html<br class="">
1481045000.296 372 10.0.0.11 TAG_NONE/200 0 CONNECT 134.170.113.207:443 - ORIGINAL_DST/134.170.113.207 -<br class="">
1481045000.325 0 10.0.0.11 TAG_NONE/400 3998 REGISTER sip:solcv.comSIP/2.0 - HIER_NONE/- text/html<br class="">
1481045008.685 4259 10.0.0.11 TAG_NONE/200 0 CONNECT 134.170.113.207:443 - ORIGINAL_DST/134.170.113.207 -<br class="">
1481045008.726 0 10.0.0.11 TAG_NONE/400 3998 REGISTER sip:solcv.comSIP/2.0 - HIER_NONE/- text/html<br class="">
<br class="">
<br class="">
although http://solve.com is in the text file.<br class="">
<br class="">
I ran whois on the first IP and got:<br class="">
<br class="">
NetRange: 132.245.0.0 - 132.245.255.255<br class="">
CIDR: 132.245.0.0/16<br class="">
NetName: MICROSOFT<br class="">
<br class="">
<br class="">
Same with the 134.170. address. Can we slice that range?<br class="">
<br class="">
<br class="">
<br class="">
<br class="">
<br class="">
Sameh Onaissi<br class="">
Ingeniero de Soporte<br class="">
Sol Cable Visión<br class="">
Cel: 316-3023424<br class="">
Email: mailto:sameh.onaissi@solcv.com<br class="">
<br class="">
<br class="">
<br class="">
Piensa en el medio ambiente antes de imprimir este email. <br class="">
<br class="">
On Dec 6, 2016, at 12:11 PM, Eliezer Croitoru <mailto:eliezer@ngtech.co.il> wrote:<br class="">
<br class="">
Hey,<br class="">
<br class="">
Depends on your OS you will need to installthe ipset package.<br class="">
Try to run “apt-get install ipset”.<br class="">
And then run the script.<br class="">
<br class="">
Eliezer<br class="">
<br class="">
----<br class="">
http://ngtech.co.il/lmgtfy/<br class="">
Linux System Administrator<br class="">
Mobile: +972-5-28704261<br class="">
Email: mailto:eliezer@ngtech.co.il<br class="">
<Untitled Attachment 1.jpg><br class="">
<br class="">
From: Sameh Onaissi [mailto:sameh.onaissi@solcv.com] <br class="">
Sent: Tuesday, December 6, 2016 5:23 PM<br class="">
To: Amos Jeffries <mailto:squid3@treenet.co.nz><br class="">
Cc: Eliezer Croitoru <mailto:eliezer@ngtech.co.il><br class="">
Subject: Re: [squid-users] Skype for Business behind a transparent squid (TProxy) HTTP/S<br class="">
<br class="">
Amos, thanks for the reply. <br class="">
<br class="">
<br class="">
This is getting more confusing.<br class="">
<br class="">
I changed the script to: http://pastebin.com/jLgywstg<br class="">
<br class="">
And I ran it, but I am getting errors:<br class="">
<br class="">
sudo sh http://bypass.sh/ + iptables -t mangle -L PREROUTING + grep bypasspool + [ 1 -ne 0 ] + iptables -t mangle -I PREROUTING -m set --match-set bypasspool dst,src -j DIVERT iptables http://v1.6.0/ Set bypasspool doesn't exist. Try `iptables -h' or 'iptables
--help' for more information. + ipset create bypasspool hash:ip http://bypass.sh/ 10: http://bypass.sh/ ipset: not found + read item + echohttp://lyncdiscover.solcv.com/ http://lyncdiscover.solcv.com/ + host -4 http://lyncdiscover.solcv.com/ + grep has address
+ awk {print $4} + xargs -l1 ipset add bypasspool xargs: ipset: No such file or directory + read item + echo http://webdir0a.online.lync.com/http://webdir0a.online.lync.com/ + host -4 http://webdir0a.online.lync.com/ + grep has address + awk {print $4} + xargs
-l1 ipset add bypasspool xargs: ipset: No such file or directory<br class="">
<br class="">
… this goes on the same for all the domains in the text file<br class="">
<br class="">
My iptables is still <http://pastebin.com/SqpbmYQQ><br class="">
<br class="">
I did not quite understand what you meant by <br class="">
You should test whether -m set or -m socket work faster and put that one<br class="">
first. My change above places it at line 2 (after -m socket) assuming<br class="">
your iptables script is still <http://pastebin.com/SqpbmYQQ><br class="">
<br class="">
should I incorporate the bypass script into my iptables.sh script? run iptables first then bypass?<br class="">
<br class="">
<br class="">
<br class="">
On a side note, would adding ssl_bump exceptions to squid.conf do it?<br class="">
Something like: <br class="">
<br class="">
acl skype_domains <path to file><br class="">
ssl_bump splice skype_domains<br class="">
ssl_bump bump all<br class="">
<br class="">
<br class="">
<br class="">
Again, thanks again for your help.<br class="">
<br class="">
<br class="">
<br class="">
<Untitled Attachment 2.jpg> Piensa en el medio ambiente antes de imprimir este email.<br class="">
<br class="">
On Dec 6, 2016, at 9:50 AM, Amos Jeffries <mailto:squid3@treenet.co.nz> wrote:<br class="">
<br class="">
On 7/12/2016 3:19 a.m., Sameh Onaissi wrote:<br class="">
Hello,<br class="">
<br class="">
I tried doing the changes to nat/REDIRECT in iptables.sh and I must have messed up somewhere, so I am sticking with mangle/tproxy for now since squid is working with them.<br class="">
<br class="">
How can I change Eliezer’s script to mangle/tproxy? https://gist.github.com/elico/e0faadf0cc63942c5aaade808a87deef<br class="">
<br class="">
Excuse my novice knowledge in iptables.<br class="">
<br class="">
No worries.<br class="">
<br class="">
You need to change where iptables attaches the 'bypasspool'. Both the<br class="">
table/location (-t) and the jump/action (-j).<br class="">
<br class="">
iptables -t mangle -L PREROUTING |grep bypasspool<br class="">
if [ "$?" -ne "0" ];then<br class="">
<br class="">
iptables -t mangle -I 2 PREROUTING \<br class="">
-m set --match-set bypasspool dst,src \<br class="">
-j DIVERT<br class="">
<br class="">
fi<br class="">
<br class="">
You should test whether -m set or -m socket work faster and put that one<br class="">
first. My change above places it at line 2 (after -m socket) assuming<br class="">
your iptables script is still <http://pastebin.com/SqpbmYQQ><br class="">
<br class="">
(Your script should do that line adding, not Eliezers - so that you can<br class="">
be sure the order is always correct).<br class="">
<br class="">
<br class="">
BTW: you should use iptables-save / iptables-restore instead of a slow<br class="">
script calling iptables "manually". Those other tools will ensure there<br class="">
are no gaps in the firewall initialization for nasty traffic to sneak<br class="">
through.<br class="">
<br class="">
I am looking at access.log to collect all domains I see heading to skype for business, as well as IPs. My question is, can I add the domains AND IPs into the domains-to-bypass.txt that the above script uses?<br class="">
<br class="">
IIRC you should be able to use domain as the parameter to ipset. But it<br class="">
will resolve the domain immediately and only add those IPs that it finds<br class="">
at that time into the pool. Any future changes, or a hidden set of IPs<br class="">
that rotate in/out will not be listed.<br class="">
<br class="">
Amos<br class="">
<br class="">
<br class="">
<br class="">
<br class="">
</div>
</div>
</blockquote>
</div>
<br class="">
</div>
</body>
</html>