Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a customer that wants to intercept SSL traffic as it leaves their network. My proposed solution is to setup a proxy that is transparent and both layer 2 and layer 3 so it can simply be dropped into their network without any change in config required. The proxy has two NICs, one connected to the server, the other to the client. The client, proxy and gateway are under control of the customer, the server is not.

For example:

client --- Proxy --- gateway -|- server

I have my proxy program configured with IP_TRANSPARENT socket option to it can respond to connections destined for a remote IP.

I am using the following setup:

iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --on-port 3128 --tproxy-mark 1/1
iptables -t mangle -A PREROUTING -p tcp -j MARK --set-mark 1
ip rule add fwmark 1/1 table 1
ip route add local dev lo table 1

The client in question is on its own subnet and has been configured so that the proxy is the default gateway.

The result is:

  1. Client sends a frame to the proxy; source IP is client, source mac is client, destination IP is server, destination mac is proxy
  2. Proxy forwards this frame to the gateway; source IP is proxy, source mac is proxy, destination IP is server, destination mac is gateway
  3. Gateway forwards this to the server and gets a response back.
  4. Gateway sends reply back to proxy; source IP is server, source mac is gateway, destination IP is proxy, destination mac is proxy
  5. Proxy forwards this reply to client; source IP is server, source mac is proxy, destination IP is client, destination mac is client. The tproxy and iptables configuration lets the proxy send packets with a non local ip address.

Is there a way to make something transparent at the mac address level? That is, put the client on the same subnet as the gateway. The gateway sees the source IP and mac as that of the client, even though they originated from the proxy. Could this be done by configuring the proxy as a bridge then use ebtables to escalate the traffic to be handled by iptables?

When I use ebtables to push something up to iptables, it appears my proxy program doesn't respond to the packets as they are destined for the gateways's mac address, not the proxy's.

What are some other potential avenues I could investigate?

EDIT: When the client and gateway are on different subnets (and client has set the proxy as the gateway), it works as described in 1 to 5. But I want to know if it is possible to have the client and gateway on the same subnet and have the proxy fully transparent (ie client is not aware of the proxy). The customer doesn't want to move some clients to a different subnet, they just want a drop in solution. Thanks!

EDIT 2: I can configure the proxy as a bridge using brctl, but cannot find a way to direct this traffic to my proxy program - asked here Possible for linux bridge to intercept traffic?. Currently, with the description numbered 1 to 5, it operates at layer 3; it is transparent on the client side (client thinks it is talking to the server's IP), but not on the gateway side (gateway is talking to the proxy's IP). What I want to find out is, is it possible to make this operate at layer 2, so it is fully transparent? What are the available options I should research? Thanks

EDIT 3: clarified the situation with more detail.

share|improve this question

closed as off-topic by Falcon Momot, womble, kasperd, Scott Pack, Ward Sep 7 '15 at 18:30

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions should demonstrate reasonable business information technology management practices. Questions that relate to unsupported hardware or software platforms or unmaintained environments may not be suitable for Server Fault - see the help center." – Falcon Momot, kasperd, Scott Pack
If this question can be reworded to fit the rules in the help center, please edit the question.

Why do you need to do this? I don't think it can be done. MAC addresses can not cross beyond the local subnet. – Khaled Aug 30 '12 at 14:11
a network schematic would help alot, what is where and connected to what. – mulaz Aug 30 '12 at 14:21
client --- proxy --- server – A G Aug 30 '12 at 14:28
@Khaled I want the server to see the request as coming from the client's mac address, not the proxy's mac address I want to do this so it looks like the client and server are talking directly to each other. – A G Aug 30 '12 at 14:33
You can use whatever you want: eb/iptables is doing all the work. However, you won't see the client MACs "on the other side" because whole point of proxy is to, well, proxy the traffic. Since I'm assuming there's NAT at the gateway anyways, so not sure what you mean by "need to see MAC address of client". The bridge box will, but not the websites, servers, etc. – gravyface Aug 31 '12 at 14:27

If the machines are on the same subnet the answer is no. Within a subnet, the ethernet protocol delivers the packets from machine to machine, and at the ethernet layer, the MAC address is the true source address, and IP addresses are unknown.

share|improve this answer
When I configure my machine as a bridge with brctl addbr0 brctl addif br0 eth1 brctl addif br0 eth2 ip link set br0 up the mac addresses are preserved since it is operating as a layer 2 bridge. So you're saying it is not possible to have a listener program on this machine modifying the packets as they pass through? For example use ebtables and iptables to intercept this traffic and bring it up to my program. I've had a go, but not sure if I have ebtables and iptables configured correctly. – A G Aug 31 '12 at 14:40

Not the answer you're looking for? Browse other questions tagged or ask your own question.