Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I've tried several different combinations of rules and nothing seems to be working. I know that you can't use prerouting table for a request coming from the localhost so I used the output table and that just returns errors when using wget.

I have wget configured to use a proxy When I use the command below I get my public IP. If I change the command to remove the --no-proxy I get the IP from my proxy.

I want to use iptables to force any request for this site through the proxy regardless of the program requesting it. I'm essentially trying to create a transparent proxy but only for the request of one site.

System = Debian Squeeze

wget command:

wget --no-proxy -q -O - checkip.dyndns.org|sed -e 's/.*Current IP Address: //' -e 's/<.*$//'

I've enabled net.ipv4.ip_forwarding=1 in /etc/sysctl.conf.

Rules attempted:

iptables -t nat -I OUTPUT --source 0/0 --destination checkip.dyndns.org -p tcp -j REDIRECT --to-ports 8118
iptables -t nat -I OUTPUT -p tcp -d checkip.dyndns.org -j REDIRECT --to-ports 8118
iptables -t nat -I PREROUTING -p tcp -s localhost -j DNAT --to
iptables -t nat -I OUTPUT --source localhost --destination checkip.dyndns.org -p tcp -j REDIRECT --to-ports 8118

And various others that are all similar.

share|improve this question

1 Answer 1

up vote 1 down vote accepted

You actually mentioned the right term for this (transparent proxy). First, you need to have a proxy server that supports transparent proxying. Second, you need to redirect HTTP requests to it using iptables as follows:

iptables -A OUTPUT -d checkip.dyndns.org -p tcp --dport 80 -j DNAT --to-destination

Using such a rule tells your machine to redirect all outgoing http requests on port 80 to your local proxy on port 8118. Also, writing rules that depend on DNS names is not a good idea especially when the DNS name-to-IP-mapping changes. iptables will just translate the name to IP and use that IP instead of name.

share|improve this answer
I'm using the checkip.dyndns.org for testing. It has 3 IPs associated with it (according to nslookup) When using the DNS name iptables makes 3 rules with each IP address. Ultimately I'm going to be using a single IP address instead of a DNS name. Thanks for the reminder though. –  shawn May 24 '12 at 19:34
woops. enter submitted my last comment when all I wanted was a new line. I got this to work. I assumed that Privoxy did transparent proxy. It doesn't but does do "intercepting" proxy, which it turns out is what I needed. I set "accept-intercepted-requests 1" in the config. I did have to add "-t nat" to the command you gave because dmesg complained that "DNAT target: only valid in nat table, not filter". Thanks for the help. I will mark this as answered. –  shawn May 24 '12 at 19:38
@shawn: Yes, you need to include -t nat in the command as this is NAT rule not a filtering one. –  Khaled May 25 '12 at 12:46

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.