iptables redirects packets to local proxy

iptables redirects packets to local proxy

[ilic_68]

[-- Attachment #1: Type: text/plain, Size: 653 bytes --]

Hello,

consider this scenario:

PC1 wants to telnet to SRV1 tcp 40000.

I would like to put a proxy in the middle that receives the
connection, rewrites the destination, sends packet to a local socks proxy (redsocks).

So the scenario would be:

PC1 --> PROXY tcp 20000 [iptables rewrites destination to SRV tcp 40000 --> redsocks 127.0.0.1 tcp 12345] --> SRV1 tcp 40000

I tried:
iptables -t nat -A PREROUTING -p tcp -s $MYSOURCEIP --dport 20000 -j DNAT --to $SRV1:40000

It works, but I know it doesn't go through redsocks.
I just changed the destination for the packets but how can I force them to flow into redsocks?

Thank you for any help, Ilic

Re: iptables redirects packets to local proxy

[Phil Oester]

On Sat, Nov 30, 2013 at 09:46:06AM -0700, ilic_68@yopmail.com wrote:
> Hello,
> 
> consider this scenario:
> 
> PC1 wants to telnet to SRV1 tcp 40000.
> 
> I would like to put a proxy in the middle that receives the
> connection, rewrites the destination, sends packet to a local socks proxy (redsocks).
> 
> So the scenario would be:
> 
> PC1 --> PROXY tcp 20000 [iptables rewrites destination to SRV tcp 40000 --> redsocks 127.0.0.1 tcp 12345] --> SRV1 tcp 40000

Use -j REDIRECT --to 12345

Re: iptables redirects packets to local proxy

[Phil Oester]

On Sat, Nov 30, 2013 at 07:56:22PM +0000, Antonio Prado wrote:
> On 30/11/13 17:40, Phil Oester wrote:
> > Use -j REDIRECT --to 12345
> 
> If I get it correctly, the OP wants to redirect to 127.0.0.1:12345 after
> having changed destination address and port to the packets.
> Is that possible anyway?

You have to pick where you want to change the destination to.  Either x:12345
or y:40000 - can't have it both ways.  Seems the socks proxy should be configured
to send the traffic to y:40000.  

Phil

Re: iptables redirects packets to local proxy

[Antonio Prado]

On 30/11/13 20:17, Phil Oester wrote:
> Seems the socks proxy should be configured to send the traffic to y:40000.

Right, without using iptables at all for redirecting, socat can do it all.

For example:
socat TCP4-LISTEN:20000,reuseaddr,fork \
SOCKS4:127.0.0.1:A.B.C.D:40000,socksport=12345

--
antonio