Iptables – Redirect all the http and https traffic throught a SOCKS proxy

httpiptablesPROXYsocks

I have a virutal network in VMWare with 2 virtual machines.

A: Not connected to Internet but is connected to B

B: Conntected to Internet and to A (interface for A is 192.168.16.2)

I have to create a SOCKS proxy to redirect all the TCP (and HTTP/S) traffic from A to B.

In such way, A can use Internet.

For this i installed REDSOCKS on A with this configuration (redsocks.conf):

base {
       log_debug = on;
       log_info = on;
       log = "stderr";
       daemon = on;
       redirector = iptables;
}
redsocks {
       local_ip = 127.0.0.1;
       local_port = 12345;

       ip = 192.168.16.2;
       port = 1337;
       type = socks5;
       login = "Bmachine";
       password = "Bmachine";
}

And i start redsocks with

sudo redsocks -c redsocks.conf

then i start ssh on B with this command:

ssh -N -D 0.0.0.0:1337 127.0.0.1

And to redirect all the traffic into the proxy, on A i do the following commands:

sudo iptables -t nat -N REDSOCKS

sudo iptables -t nat -A REDSOCKS -d 0.0.0.0/8 -j RETURN
sudo iptables -t nat -A REDSOCKS -d 10.0.0.0/8 -j RETURN
sudo iptables -t nat -A REDSOCKS -d 127.0.0.0/8 -j RETURN
sudo iptables -t nat -A REDSOCKS -d 169.254.0.0/16 -j RETURN
sudo iptables -t nat -A REDSOCKS -d 172.16.0.0/12 -j RETURN
sudo iptables -t nat -A REDSOCKS -d 192.168.0.0/16 -j RETURN
sudo iptables -t nat -A REDSOCKS -d 224.0.0.0/4 -j RETURN
sudo iptables -t nat -A REDSOCKS -d 240.0.0.0/4 -j RETURN

sudo iptables -t nat -A REDSOCKS -p tcp -j REDIRECT --to-ports 12345

sudo iptables -t nat -A OUTPUT -p tcp --dport 443 -j REDSOCKS
sudo iptables -t nat -A OUTPUT -p tcp --dport 80 -j REDSOCKS

sudo iptables -t nat -A PREROUTING -p tcp --dport 443 -j REDSOCKS
sudo iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDSOCKS

That's all but when i try to use Internet or open Firefox from A, i can't reach nothing, Internet doesn't work.

Best Answer

You need to run the ssh command on A

ssh -N -D 1337 b_username@ip_of_b

You can then configure your web-browser or set environment variables to point at this proxy: 127.0.0.1:1337

If you want to use redsocks so that all TCP traffic destined for port 80 or 443 is directed to the proxy then you can update the config:

redsocks {
       local_ip = 127.0.0.1;
       local_port = 12345;

       ip = 127.0.0.1;
       port = 1337;
       type = socks5;
}

Side note: If you're not tunnelling traffic through A then you also don't need the PREROUTING rules in iptables.

Related Topic