0

I want to inspect and modify the http requests from one process sent to another. For that I have a proxy running on localhost port 8080/tcp. The process owner is root, and the application it sends to runs on localhost port 50000/tcp. The process spawns new sub-processes, that's why I'm chosing the above route. I can't use --pid-owner. How would the iptables command for this look like?

Or phrased differently:

Situation:

  • There is one process p2, that communicates using HTTP with another process p1.
  • p2 and p1 run on localhost
  • p1 runs on 50000/tcp
  • p2 -> p1

Goal:

  • Run the traffic through a proxy.
  • Proxy also runs on localhost.
  • Port 8080/tcp.
  • p2 -> proxy -> p1

Difficulties:

  • I don't have the option to specify a proxy in p2.
  • Everything runs on localhost
  • Not unless nethogs can forward traffic. I want not only to see the traffic - I could use wireshark for that and filter for port 50000, but I need to intercept it to manipulate it as well. – user857990 Sep 4 '17 at 14:41
  • Ah, then I misread. If it's enough for you to filter for root, you could use -m owner --uid-owner 0 and the corresponding ports. – Lenniey Sep 4 '17 at 15:05
  • Can you state the full iptables command? – user857990 Sep 4 '17 at 15:06
  • 1
    I really don't know why you don't just forward the traffic of port 50000. Why do you need the user or the process? The full iptables command depends on where you want to have your traffic etc.. I suppose you want to forward it to 8080? I also assume that there are better ways to do this and suggest that you rephrase your question. – Lenniey Sep 4 '17 at 15:10
  • How should the proxy forward the traffic afterwards to the process running on 50000/tcp if everything is forward to the proxy itself running on 8080/tcp? – user857990 Sep 4 '17 at 15:12
4

We need to intercept the P2 connection to localhost TCP/50000 and forward it to the PROXY listening on TCP/8080 - The PROXY has to be configured to forward the request to LOCALHOST TCP/5000.

For this to work we need to activate the forwarding of localhost ports to IPTABLES, changing following system parameter:

sysctl -w net.ipv4.conf.all.route_localnet=1

Afterwards this IPTABLES command should take the P2 connection to TCP/50000 and do a NAT to the PROXY listening on port TCP/8080:

iptables -t nat -A OUTPUT -m addrtype --src-type LOCAL --dst-type LOCAL -m owner --uid-owner 0 -p tcp --dport 50000 -j DNAT --to-destination 127.0.0.1:8080

This configuration may also work using an external PROXY (meaning not running on the same machine where P1 & P2 are running) changing the IP address 127.0.0.1 to the external one in:

--to-destination X.X.X.X:8080

Hope this helps.

  • Thanks! That is what I needed. I added just one missing component. Key was the missing route_localnet=1! Not sure why your answer got downvoted. – user857990 Sep 6 '17 at 11:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.