After reading a bit about TPROXY (e.g at https://www.kernel.org/doc/html/latest/networking/tproxy.html ) I now have more questions then answers. I actually don't even know what TPROXY should do...
Some assumptions about what I should do and what happens inside.
Can you correct the following assumptions ?
From what i understand these are the commands that you should run (although i have no idea why):
iptables -t mangle -N DIVERT
:- A chain named
DIVERT
is created. - You can choose the name. (As long as it's the same in all commands).
- It has to be part of
mangle
because you will being doing things that are less trivial than redirecting, blocking and NAT.
- A chain named
iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT
:- The
PREROUTING
chain makes sure that once a TCP packet is passed from a networkdevice to the kernel, the very first thing that will happen is that it is being sent to theDIVERT
chain. -p tcp
makes sure that this it is not the case for non-TCP traffic .-m socket
makes sure that this it is not the case for packets that create and close the connection (e.g.SYN/ACK
)- By removing
-p tcp -m socket
TPROXY will affect all IP(v4) packets. It will be a different, but working, setup.
- The
iptables -t mangle -A DIVERT -j MARK --set-mark 1
:- The kernel will mark those packets with the number
1
. You can choose another number. - It's also possible to add multiple marks to a packet. For example: By adding the command
iptables -t mangle -A DIVERT -i eth0 -j MARK --set-mark 2
you would make sure that all TCP-packages get the mark1
and all TCP-packages that arrive frometh0
get both the mark1
and2
. - "Marking with number
X
" just means "categorizing as member of categoryX
without actually changing anything in the packet". - Both the kernel and programs in userspace can read the mark(s) of packets
- Only the kernel can mark packets
- The kernel will mark those packets with the number
iptables -t mangle -A DIVERT -j ACCEPT
: By default the kernel discards the packets so you are now making sure it doesn't.ip rule add fwmark 1 lookup 100
:- Instead of using the default routingtable, all packets with mark
1
now use a table named100
. - You can use choose another number, as long as you make sure that you use the same number everywhere else
- Instead of using the default routingtable, all packets with mark
ip route add local 0.0.0.0/0 dev lo table 100
:- Creates table
100
if it didn't exist already - Adds a routing roule that makes sure that all packages that originate from our system (
local
) stay local by sending them back tolo
- That this is the case for packages with any destination
0.0.0.0/0
(each ipv4 adddress is a member of this subnet) - But that it's not the case for packages that are not marked
1
(otherwise they wouldn't end up in100
)
- Creates table
iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 50080
:- All packets sent to
tcp/80
receive the mark1
and end up attcp/50080
- For some, to me, unknown reason, they are marked. (It looks to me that they pass by
DIVERT
anyway where they are marked again) - For some, to me, unknown reason
0x1
is written twice
- All packets sent to
My assumption about what the purpose of TPROXY is: Re-routing packets without altering them
-t mangle ... --tproxy-mark 0x1/0x1 --on-port xxxx
: you modify the packet setting the mark, this is before routing ->ip rule add fwmark 1 lookup 100
: the rule catch the packets marked and looks up on the 100 routing table ->ip route add local 0.0.0.0/0 dev lo table 100
: everything by default (0.0.0.0/0) will go todev lo
(localhost). So, the marked packets will go to localhost on port xxxx.