2

I followed this answer: Redirect all non-local traffic to a socks proxy

root@xxx:~# cat /proc/sys/net/ipv4/ip_forward
1

root@xxx:~# netstat -tapln | grep :4545 | grep LISTEN
tcp        0      0 127.0.0.1:4545          0.0.0.0:*

The port works fine when I connect the socks5 through curl:

root@xxx:~# curl -x socks5h://127.0.0.1:4545 ifconfig.co
1.2.3.4

When I run enable iptables rules, i see my computer's ip:

iptables -P FORWARD ACCEPT
iptables -t nat -A POSTROUTING -j MASQUERADE
iptables -t nat -A PREROUTING -p tcp -j REDIRECT --to-ports 4545

root@xxx:~# curl ifconfig.co
9.8.7.6

However, 4545th port is a socks5 proxy. It should be working.

I couldn't figure out what is wrong there.

I tried to use FoxyProxy. It works fine. But I want to redirect all traffic through socks5proxy. How can i do it?

P.S.: I don't have any DROP/REJECT rule in iptables. I have only those 3 rules.

user337738
  • 21
  • 1
  • 1
  • 2

1 Answers1

2

First thing: the SOCKS proxy also has to be able to work in some kind of transparent mode (ie: it won't receive a request using the SOCKS protocol but has to handle it anyway using side band information from iptables' REDIRECT action). The Q/A you linked tells the same:

With these rules, the requests arrive to the port on which there must be "something" well configured to get working everything.

So don't expect this solution to do more than what you're asking: to have everything redirected to the SOCKS proxy.

What you're missing is that you're doing the test from the host running the iptables REDIRECT. That means it's not a router for the local outgoing traffic, so the PREROUTING chain is never called.

What you have to use instead (or in addition) is the nat/OUTPUT chain (but see the additional issue described later):

iptables -t nat -A OUTPUT -p tcp -j REDIRECT --to-ports 4545

If you tried this alone, there would be a loop: the SOCKS proxy (assuming it's really able to work transparently, see above) will now be redirected to itself and nothing will ever go out. The easiest way to avoid this is to have the proxy run with a dedicated user or group to make an exception. So let's assume the proxy is running as user ... proxy, replace above with this instead:

iptables -t nat -A OUTPUT -p tcp -m owner ! --uid-owner proxy -j REDIRECT --to-ports 4545

And/or you can choose to also not redirect the root user for example by also adding this exception before (hence -I here) the previous line:

iptables -t nat -I OUTPUT -p tcp -m owner --uid-owner root -j RETURN

Final remark: REDIRECT has been obsoleted in favor of TPROXY, but its use is a bit more tricky and still requires (different) support from the transparent proxy.

A.B
  • 31,762
  • 2
  • 62
  • 101