Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to create a custom proxy program but I have a problem.

My program connects to a fixed port from a random port and I need to tunnel all this traffic by my local proxy.

I think the solution is using iptables, but all the topics I found are related to redirect incoming connections, not outbounds.

How can I redirect all the traffic from a local port to another local port and later to the internet?


share|improve this question
So the scenario is: you have a program which generates some traffic and you want to proxy this traffic via some other program right? - Are both programs running on the same machines? - What kind of traffic is that? TCP connections? – Jacek Konieczny Mar 5 '10 at 12:47
Yes, TCP traffic from my machine to a server and I want to capture, analyze and, in some point in the future, modify it on fly. I was looking about socat too, but I don't know if is the right tool... – Pedro Laguna Mar 5 '10 at 14:27

iptables -t nat -A OUTPUT -p tcp --dport 12345 -j REDIRECT --to-ports 54321

12345 is a port your program tries to connect to

54321 is your proxy server port

You can also specify additional options like "-m owner --uid-owner qqq" to redirect only connections of user qqq or "-d" to redirect only connections intended for host

The proxy program can easily obtain the destination address before redirection if it wants.

If you need to just connect somewhere, run socat tcp-l:54321,fork,reuseaddr tcp:

share|improve this answer
Fantastic!! I finally added the ! --gui-owned <proxy group> to remove the proxy tool from the redirection and get my outgoing packets from my proxy. But the incoming ones are not being received by the application. Maybe I have to make another INPUT rule? Thanks – Pedro Laguna Mar 24 '10 at 11:41
"! --gid-owner" is for OUTPUT, because of you don't know yet what application will receive the packet in INPUT chain. You should probably do "--gid-onwer <application group>" (without negation) only for your application to make everything else not to be redirected. – Vi. Mar 24 '10 at 21:42
I'm currently using this rule to OUTPUT: iptables -t nat -A OUTPUT -p tcp --dport X -j REDIRECT --to-ports Y -m owner ! --gid-owner G And I supposed I have to use something like this to redirect the incoming traffic to the proxy: iptables -t nat -A INPUT -p tcp --dport Y -j REDIRECT --to-ports X -m owner --gid-owner G It's right? – Pedro Laguna Mar 26 '10 at 9:12
1. There is no INPUT in "-t nat" you should use PREROUTING if you really want redirection of input things. 2. There is no "-m owner" for any of incoming packets, that is in INPUT or PREROUTING. 3. "My program connects to a fixed port" redirect just this program with "-m owner" in OUTPUT. BTW there is nothing about "the incoming traffic" in question. "-t nat" things work once when a connection is establishing. Connection tracking handles the rest keeping for already established connections. – Vi. Mar 26 '10 at 11:35

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.