Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Im trying to setup a transparent proxy using IPtables but im not having much luck.

What I was hoping to do was forward all outgoing traffic to port 9040 and block everything else. Any ideas?

iptables -t nat -A OUTPUT ! -o lo -p tcp -m owner --uid-owner Mark -m tcp -j REDIRECT --to-ports 9040 

iptables -A OUTPUT -m --uid-owner Mark -j DROP

I receive the following error -

(WARNING): UDP write to failed: Operation not permitted


share|improve this question
(1) when did the error message show? (2) is your box functioning as a firewall/router or are you trying to transp-proxy traffic coming out of the box? – pepoluan Apr 7 '11 at 3:50
Im trying to send data from my local desktop ubuntu computer transparently through a proxy – markymark Apr 7 '11 at 4:01

The problem is that your rule is too restrictive.

iptables -t nat -A OUTPUT ! -o lo -p tcp -m owner --uid-owner Mark -m tcp -j REDIRECT --to-ports 9040 
iptables -A OUTPUT -m --uid-owner Mark -j DROP

The first rule redirects all TCP traffic to port 9040, without trying to discern whether it is something proxy-able (e.g., HTTP) or non-proxy-able (e.g., SSH).

The second rule drops all traffic, TCP, UDP, whathaveyou.

You should delete the second rule, and set the OUTPUT chain's policy to ACCEPT. That will allow all traffic to go through. (Although it will not fix the problem of non-proxy-able traffic gets redirected to the proxy).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.