I have a Raspberry Pi which establishes an SSH proxy to a remote server (VPS) and opens a port on the Pi so I can use it as a SOCKS proxy. This is the command I use to establish the tunnel:

ssh -D 1080 -f -C -q -N user@hostname

This shows you how it is supposed to work:

                       |                              |
                       |            Client            |
                                       | L2TP over IPSEC
                       ________________|_______________ __ 
                      |                                |  |
                      |       VPN (192.168.1.XXX)      |  |
                      |________________________________|  |
                       ________________|_______________   |-RaspberryPi
                      |                                |  | 
                      |    SOCKS5 (     |  |
                                       | SSH tunnel
                      |                                 |
                      |         VPS (Amazon EC2)        |
                                      / \
                                     /   \
                                  the internet 

These are my IP tables:

-A POSTROUTING -s -o eth+ -m policy --dir out --pol none -j MASQUERADE
-A INPUT -p udp -m udp --dport 1701 -m policy --dir in --pol none -j DROP
-A INPUT -m conntrack --ctstate INVALID -j DROP
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p udp -m multiport --dports 500,4500 -j ACCEPT
-A INPUT -p udp -m udp --dport 1701 -m policy --dir in --pol ipsec -j ACCEPT
-A INPUT -p udp -m udp --dport 1701 -j DROP
-A FORWARD -m conntrack --ctstate INVALID -j DROP
-A FORWARD -i eth+ -o ppp+ -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i ppp+ -o eth+ -j ACCEPT
-A FORWARD -s -d -i ppp+ -o ppp+ -j ACCEPT
-A FORWARD -d -i eth+ -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s -o eth+ -j ACCEPT

The script "setup-ipsec-vpn" was used to make the VPN.

So my question is: How can I change these IP tables to drop all of the VPN clients' outbound packets unless it is using the SOCKS5 proxy on the Raspberry Pi (:1080)


The answer depends in part on whether you will configure your clients.

In other words, do you intend for the SOCKS proxy to be explicit, or transparent?

If you can configure your client apps to use an explicit proxy, then it should be simple enough (although you may want to have your SOCKS listen on the VPN interface - or create a DNAT rule).

-A INPUT -s -d -m tcp -p tcp --dport 1080 -j ACCEPT

If you wanted to have a transparent proxy, I think it may be worth considering introducing haproxy.

This haproxy blog post provides an overview of how to setup transparent binding, which sounds like it might work for your use case.

You may in that case find it easier to have SSH in tunnel mode rather than SOCKS (or add another VPN connection between Pi and gateway).

The specific rule causing your 'issue' right now is, I think, this one:

-A FORWARD -i ppp+ -o eth+ -j ACCEPT

More generally, it seems as though you might want to rewrite your firewall rules to achieve what you want.

  • The SOCKS proxy is explicit and defined in the VPN profiles for the clients. However, if the proxy is down, it ignores it and just uses the RaspberryPi's connection. I want to stop that from happening. If the proxy is down, their requests should not go anywhere – user3573987 Apr 9 '17 at 12:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.