Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to redirect the traffic that goes through my OpenVPN gateway to Privoxy, like so:

OpenVPN client->Internet->OpenVPN gateway->Privoxy->Internet->Webserver (and vice versa)

So far I managed to get the OpenVPN gateway working fine. Connecting to the Privoxy proxy appears to be working aswell. But redirecting port 80 traffic via iptables just won't work (external webservers are unreachable). What would my iptables config file have to look like?

Thanks in advance

PS: This is what I came up with so far...

iptables -t nat -A POSTROUTING -o eth0 -s -j MASQUERADE

iptables -I FORWARD -i tap0 -j ACCEPT
iptables -I FORWARD -o tap0 -j ACCEPT

# No success with the following line
iptables -t nat -A PREROUTING -i tap0 -p tcp --dport 80 -j REDIRECT --to-port 8118
share|improve this question
What does your iptables configuration look like now? Show us what you've tried. – larsks Feb 6 '12 at 21:58
Is accept-intercepted-requests enabled? By default it's disabled: – Giovanni Toraldo Feb 6 '12 at 21:59
@GiovanniToraldo yes, sorry forgot to mention it! – Max Rother Feb 6 '12 at 22:02
@larsks edited the first post! – Max Rother Feb 6 '12 at 22:13
Still no luck. Also tried Squid now. :( – Max Rother Feb 7 '12 at 19:00

You can push proxy configuration to the OpenVPN clients.

From the OpenVPN Access Server web interface go to Advanced VPN Settings → Server Config Directives and enter the following directive with your proxy ip/port info.

push "dhcp-option PROXY_HTTP 111.222.333.44 8118"

I am not sure if all OpenVPN clients support this config. But on IOS it works well.

share|improve this answer

Privoxy is an HTTP proxy. What you're trying to do is feed it intact network packets, which I'm 99% sure it's not going to accept that without some very complex mangle rules in iptables. Instead you should expose the proxy to the VPN (seems like it is already), and push it as a DHCP option to your VPN clients.

Instructions for doing that via OpenVPN can be found here and it can be done on a client-by-client basis using the ccd directory if you have that set up.

share|improve this answer

Set up privoxy to listen on an address on the tunnel interface, for example, then just redirect VPN traffic to it:

sudo iptables -t nat -A PREROUTING --source -p tcp -m tcp --dport 80 -j DNAT --to
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.