Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have seen this used in many android based projects like "ProxyDroid" & "SSHTunnel"

Where you establish a connection to a proxy or ssh tunnel then using iptables it will redirect all tcp requests through the tunnel you have created.

It should be something like "-I OUTPUT -p tcp --destination-not --redirect-to" but I couldn't find any examples on this and I don't know if it should be inserted to nat or something else + I have no idea if I should have more than 1 rule for e.g: one more for incoming connections.


Appears to be it's not possible to use the tunnel directly Or I haven't find out how to do it without using an agent, I had to install a program called redsocks to act as a local server to make this work.

As for the iptables commands used here it is:

# do not redirect connection sent to localhost so redirected connections can reach
# its destination, otherwise we'll stuck in a loop.
iptables -t nat -A OUTPUT -d -j ACCEPT
# Redirect all tcp connections except ones that are going to my tunnel server 
# to the local redsocks port
iptables -t nat -A OUTPUT -p tcp ! -d -j REDIRECT --to-ports 31338

RedSocks Repo:

Now everything works great, but I still need to know if this can be accomplished without the redsocks (connecting to tunnel directly).

share|improve this question

Do you mean to set up a poor man's VPN over SSH? If so, there's some Ubuntu documentation for this:

Basically, you would use the "-w" option to set up a new tun0 interface, and start routing through it. iptables is not involved, though you will need to set up routes.

Note that doing TCP over TCP may be a bad idea. A better option might be a simple VPN, like with OpenVPN, but that will be more complicated than a quick-and-dirty ssh tunnel.

share|improve this answer
This would require having root access on both machines and configuring it manually on each connect or on each separate machines, and looks somewhat complicated for me. The iptables solution would be much easier, I am just unable to find the commands used by the apps, I will try to extract these commands from google code (where the sources are hosted) but as I am not familiar with these mobile apps I might not be able to do so. – Frank Aug 24 '12 at 19:30

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.