Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm trying to create a custom proxy program but I have a problem.

My program connects to a fixed port from a random port and I need to tunnel all this traffic by my local proxy.

I think the solution is using iptables, but all the topics I found are related to redirect incoming connections, not outbounds.

How can I redirect all the traffic from a local port to another local port and later to the internet?

Thanks,

share|improve this question
    
So the scenario is: you have a program which generates some traffic and you want to proxy this traffic via some other program right? - Are both programs running on the same machines? - What kind of traffic is that? TCP connections? –  Jacek Konieczny Mar 5 '10 at 12:47
    
Yes, TCP traffic from my machine to a server and I want to capture, analyze and, in some point in the future, modify it on fly. I was looking about socat too, but I don't know if is the right tool... –  Pedro Laguna Mar 5 '10 at 14:27

1 Answer 1

iptables -t nat -A OUTPUT -p tcp --dport 12345 -j REDIRECT --to-ports 54321

12345 is a port your program tries to connect to

54321 is your proxy server port

You can also specify additional options like "-m owner --uid-owner qqq" to redirect only connections of user qqq or "-d 11.22.33.44" to redirect only connections intended for host 11.22.33.44.

The proxy program can easily obtain the destination address before redirection if it wants.

If you need to just connect somewhere, run socat tcp-l:54321,fork,reuseaddr tcp:11.22.33.44:12345

share|improve this answer
    
Fantastic!! I finally added the ! --gui-owned <proxy group> to remove the proxy tool from the redirection and get my outgoing packets from my proxy. But the incoming ones are not being received by the application. Maybe I have to make another INPUT rule? Thanks –  Pedro Laguna Mar 24 '10 at 11:41
    
"! --gid-owner" is for OUTPUT, because of you don't know yet what application will receive the packet in INPUT chain. You should probably do "--gid-onwer <application group>" (without negation) only for your application to make everything else not to be redirected. –  Vi. Mar 24 '10 at 21:42
    
I'm currently using this rule to OUTPUT: iptables -t nat -A OUTPUT -p tcp --dport X -j REDIRECT --to-ports Y -m owner ! --gid-owner G And I supposed I have to use something like this to redirect the incoming traffic to the proxy: iptables -t nat -A INPUT -p tcp --dport Y -j REDIRECT --to-ports X -m owner --gid-owner G It's right? –  Pedro Laguna Mar 26 '10 at 9:12
    
1. There is no INPUT in "-t nat" you should use PREROUTING if you really want redirection of input things. 2. There is no "-m owner" for any of incoming packets, that is in INPUT or PREROUTING. 3. "My program connects to a fixed port" redirect just this program with "-m owner" in OUTPUT. BTW there is nothing about "the incoming traffic" in question. "-t nat" things work once when a connection is establishing. Connection tracking handles the rest keeping for already established connections. –  Vi. Mar 26 '10 at 11:35

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.