0

Im trying to setup a transparent proxy using IPtables but im not having much luck.

What I was hoping to do was forward all outgoing traffic to port 9040 and block everything else. Any ideas?

iptables -t nat -A OUTPUT ! -o lo -p tcp -m owner --uid-owner Mark -m tcp -j REDIRECT --to-ports 9040 

iptables -A OUTPUT -m --uid-owner Mark -j DROP

I receive the following error -

(WARNING): UDP write to 68.32.239.182:21755 failed: Operation not permitted

Thank-you

  • (1) when did the error message show? (2) is your box functioning as a firewall/router or are you trying to transp-proxy traffic coming out of the box? – pepoluan Apr 7 '11 at 3:50
  • Im trying to send data from my local desktop ubuntu computer transparently through a proxy – markymark Apr 7 '11 at 4:01
1

The problem is that your rule is too restrictive.

iptables -t nat -A OUTPUT ! -o lo -p tcp -m owner --uid-owner Mark -m tcp -j REDIRECT --to-ports 9040 
iptables -A OUTPUT -m --uid-owner Mark -j DROP

The first rule redirects all TCP traffic to port 9040, without trying to discern whether it is something proxy-able (e.g., HTTP) or non-proxy-able (e.g., SSH).

The second rule drops all traffic, TCP, UDP, whathaveyou.

You should delete the second rule, and set the OUTPUT chain's policy to ACCEPT. That will allow all traffic to go through. (Although it will not fix the problem of non-proxy-able traffic gets redirected to the proxy).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.