1

I've tried several different combinations of rules and nothing seems to be working. I know that you can't use prerouting table for a request coming from the localhost so I used the output table and that just returns errors when using wget.

I have wget configured to use a proxy 127.0.0.1:8118. When I use the command below I get my public IP. If I change the command to remove the --no-proxy I get the IP from my proxy.

I want to use iptables to force any request for this site through the proxy regardless of the program requesting it. I'm essentially trying to create a transparent proxy but only for the request of one site.

System = Debian Squeeze

wget command:

wget --no-proxy -q -O - checkip.dyndns.org|sed -e 's/.*Current IP Address: //' -e 's/<.*$//'

I've enabled net.ipv4.ip_forwarding=1 in /etc/sysctl.conf.

Rules attempted:

iptables -t nat -I OUTPUT --source 0/0 --destination checkip.dyndns.org -p tcp -j REDIRECT --to-ports 8118
iptables -t nat -I OUTPUT -p tcp -d checkip.dyndns.org -j REDIRECT --to-ports 8118
iptables -t nat -I PREROUTING -p tcp -s localhost -j DNAT --to 127.0.0.1:8118
iptables -t nat -I OUTPUT --source localhost --destination checkip.dyndns.org -p tcp -j REDIRECT --to-ports 8118

And various others that are all similar.

Improve this question

1 Answer 1

Reset to default
1

You actually mentioned the right term for this (transparent proxy). First, you need to have a proxy server that supports transparent proxying. Second, you need to redirect HTTP requests to it using iptables as follows:

iptables -A OUTPUT -d checkip.dyndns.org -p tcp --dport 80 -j DNAT --to-destination 127.0.0.1:8118

Using such a rule tells your machine to redirect all outgoing http requests on port 80 to your local proxy on port 8118. Also, writing rules that depend on DNS names is not a good idea especially when the DNS name-to-IP-mapping changes. iptables will just translate the name to IP and use that IP instead of name.

Improve this answer
3
  • I'm using the checkip.dyndns.org for testing. It has 3 IPs associated with it (according to nslookup) When using the DNS name iptables makes 3 rules with each IP address. Ultimately I'm going to be using a single IP address instead of a DNS name. Thanks for the reminder though.
    – shawn
    May 24, 2012 at 19:34
  • woops. enter submitted my last comment when all I wanted was a new line. I got this to work. I assumed that Privoxy did transparent proxy. It doesn't but does do "intercepting" proxy, which it turns out is what I needed. I set "accept-intercepted-requests 1" in the config. I did have to add "-t nat" to the command you gave because dmesg complained that "DNAT target: only valid in nat table, not filter". Thanks for the help. I will mark this as answered.
    – shawn
    May 24, 2012 at 19:38
  • @shawn: Yes, you need to include -t nat in the command as this is NAT rule not a filtering one.
    – Khaled
    May 25, 2012 at 12:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .