Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a setup where I have 2 proxy servers. One is a socks proxy which I wish to use for ALL connections by default. The second proxy is an http proxy which I wish to use for http connections to specific hosts (all on the same domain(s))

Lets assume:

  • Socks proxy is hostA:9000
  • Http proxy is hostB:8080
  • Domain that should go through http proxy is *

Can iptables be configured to do this?

share|improve this question
I don't think there is any way you would be able to do this. When your browser is talking socks, it is using a different protocol from an HTTP proxy. Is there some reason why you don't do something in the browser with a proxy switcher or a PAC file? – Zoredache Feb 7 '12 at 1:07
Simple answer: Chrome. Chrome uses system proxy, which means one or the other. – Exodist Feb 7 '12 at 15:35
How does Chrome's use of the system proxy have anything to do with what I asked or with iptables? – Zoredache Feb 7 '12 at 17:46
@exodist Chrome no longer uses the system proxy. It used to but recent versions are capable of using its own proxy. Proxy SwitchySharp (…) uses this to set up URL pattern based proxy switching. – Patrick Feb 8 '12 at 14:21

For the socks proxy you can use a utility called tun2socks (thats a link). It basically sets up a tunnel device which you can create routing rules to tunnel your traffic through. I use this for connecting to my network at work (since the proprietary vpn software on linux is crap). It works just fine with a few quirks (most notable is that it works for TCP only).

For the http proxy. In theory this should be possible, but I've never done it myself. However nixcraft has a howto, and their stuff is usually pretty good.

share|improve this answer
Hi. I'm the author of tun2socks. Could you please provide some more details on those few quirks, maybe I can do something about them? I am already planning to add proper UDP support using the SOCKS UDP ASSOCIATE feature. – Ambroz Bizjak Apr 17 '12 at 19:46
@AmbrozBizjak the other one that springs to mind is getting 'connection refused' (or other error) on the remote end, but getting 'connection closed' on the local end. I understand the reason for it, which is why I say 'quirk' instead of 'bug' :-) – Patrick Apr 17 '12 at 20:13
I see, thank you. Though the SOCKS protocol does return error codes, and if I delay accepting the connection (replying the SYN) until I get a response from SOCKS, in case of error I may be able to reply with an appropriate error back to the client instead of accepting. – Ambroz Bizjak Apr 17 '12 at 20:23

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.