1

My goal was to use ubuntu as a router, with Redsocks serving as a transparent SOCKS proxy redirector. Each machine on my network would have its TCP/UDP traffic redirected to a different port where Redsocks was listening. Example: Machine 1 would have traffic sent to port 12345, and Redsocks would hand that off to external proxy 1. Machine 2 would have traffic sent to port 12346, and Redsocks would send that to proxy 2.

I figured that iptables could handle the initial redirecting to the specific Redsocks port location. I found a case similar to mine where SNAT was employed (iptables for transparent NAT) but cannot get it to work with the following: 

iptables -t nat -N REDSOCKS
iptables -t nat -A REDSOCKS -d 0.0.0.0/8 -j RETURN
iptables -t nat -A REDSOCKS -d 10.0.0.0/8 -j RETURN
iptables -t nat -A REDSOCKS -d 127.0.0.0/8 -j RETURN
iptables -t nat -A REDSOCKS -d 169.254.0.0/16 -j RETURN
iptables -t nat -A REDSOCKS -d 172.16.0.0/12 -j RETURN
iptables -t nat -A REDSOCKS -d 192.168.0.0/16 -j RETURN
iptables -t nat -A REDSOCKS -d 224.0.0.0/4 -j RETURN
iptables -t nat -A REDSOCKS -d 240.0.0.0/4 -j RETURN
iptables -t nat -A POSTROUTING -s 192.168.50.2 -p tcp --dport 80 -j SNAT --to-source 192.168.1.50:12345
iptables -t nat -A POSTROUTING -s 192.168.50.2 -j MASQUERADE

Not sure where I'm going wrong with this.

My setup: Router has 2 NICs. Eth0 faces the WAN. Eth1 faces the LAN and has a static IP.

/proc/sys/net/ipv4/ip_forward = 1

eth0=192.168.1.50

eth1=192.168.50.1

All router clients have one NIC, static IP facing the LAN. eth1=192.168.50.2

Why I want to do this: I can run Redsocks successfully on the individual machines and transmit via their respective proxies, but I wanted to keep all the routing in one place for the sake of convenience.

Improve this question
2
  • BTW, in your iptables rules, you are never actually sending packets sending anything REDSOCKS chain. Chains only get processed when you have a rule that jumps to that chain.
    – Zoredache
    Oct 10, 2014 at 20:40
  • @Zoredache, he is using REDSOCKS, which transparently redirects traffic to a proxy.
    – Gene
    Oct 10, 2014 at 20:45

1 Answer 1

Reset to default
1

For this to work you need a DNAT rule in the PREROUTING chain and a SNAT rule in the POSTROUTING chain.

Take another look at the previous serverfault answer that you linked:

iptables -t nat -I PREROUTING -d 192.168.250.3 -j DNAT --to-destination 192.168.250.4 
iptables -t nat -I POSTROUTING -s 192.168.250.4 -j SNAT --to-source 192.168.250.3

Additionally, you do not want to set the port on the --to-source for the SNAT rule.

You will want to read up on the differences between DNAT and SNAT, which you can do here.

This document on TLDP may be able to help with this specific scenario.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .