0

I'm trying to create a custom proxy program but I have a problem.

My program connects to a fixed port from a random port and I need to tunnel all this traffic by my local proxy.

I think the solution is using iptables, but all the topics I found are related to redirect incoming connections, not outbounds.

How can I redirect all the traffic from a local port to another local port and later to the internet?

Thanks,

Improve this question
2
  • So the scenario is: you have a program which generates some traffic and you want to proxy this traffic via some other program right? - Are both programs running on the same machines? - What kind of traffic is that? TCP connections?
    – Jacek Konieczny
    Mar 5, 2010 at 12:47
  • Yes, TCP traffic from my machine to a server and I want to capture, analyze and, in some point in the future, modify it on fly. I was looking about socat too, but I don't know if is the right tool...
    – Pedro Laguna
    Mar 5, 2010 at 14:27

1 Answer 1

Reset to default
1

iptables -t nat -A OUTPUT -p tcp --dport 12345 -j REDIRECT --to-ports 54321

12345 is a port your program tries to connect to

54321 is your proxy server port

You can also specify additional options like "-m owner --uid-owner qqq" to redirect only connections of user qqq or "-d 11.22.33.44" to redirect only connections intended for host 11.22.33.44.

The proxy program can easily obtain the destination address before redirection if it wants.

If you need to just connect somewhere, run socat tcp-l:54321,fork,reuseaddr tcp:11.22.33.44:12345

Improve this answer
4
  • Fantastic!! I finally added the ! --gui-owned <proxy group> to remove the proxy tool from the redirection and get my outgoing packets from my proxy. But the incoming ones are not being received by the application. Maybe I have to make another INPUT rule? Thanks
    – Pedro Laguna
    Mar 24, 2010 at 11:41
  • "! --gid-owner" is for OUTPUT, because of you don't know yet what application will receive the packet in INPUT chain. You should probably do "--gid-onwer <application group>" (without negation) only for your application to make everything else not to be redirected.
    – Vi.
    Mar 24, 2010 at 21:42
  • I'm currently using this rule to OUTPUT: iptables -t nat -A OUTPUT -p tcp --dport X -j REDIRECT --to-ports Y -m owner ! --gid-owner G And I supposed I have to use something like this to redirect the incoming traffic to the proxy: iptables -t nat -A INPUT -p tcp --dport Y -j REDIRECT --to-ports X -m owner --gid-owner G It's right?
    – Pedro Laguna
    Mar 26, 2010 at 9:12
  • 1. There is no INPUT in "-t nat" you should use PREROUTING if you really want redirection of input things. 2. There is no "-m owner" for any of incoming packets, that is in INPUT or PREROUTING. 3. "My program connects to a fixed port" redirect just this program with "-m owner" in OUTPUT. BTW there is nothing about "the incoming traffic" in question. "-t nat" things work once when a connection is establishing. Connection tracking handles the rest keeping for already established connections.
    – Vi.
    Mar 26, 2010 at 11:35

You must log in to answer this question.