I'm trying to implement something similar to the service provided by https://www.smartdnsproxy.com, where clients only need to change their DNS settings to connect to a HTTP/S or SOCKS5 proxy. I think I understand the individual components, but I'm having trouble putting it all together.
To achieve what I want, I need to provide the following services to clients:
- DNS server, I'm using
- SOCKS proxy, I'm using
Then, once a client has set the DNS to my server and a request is sent, the goal is for the following to happen:
- User performs DNS request asking where is
- My DNS server responds "It is
- User then sends an HTTP/S request to the proxy's IP address, e.g.
GET /about.html HTTP/1.1 Host: example.com
- Proxy server handles the incoming request (likely in port 80 or 443) and returns result to the client
I was able to setup both services, and they appear to work well independently. I have configured
dnsmasq to resolve all domains with the proxy's IP address, and I can setup a client just fine. I have configured
dante to listen to port 1080, and I can verify that a client can use the proxy, tested with the handy
Then, to forward the incoming requests from the HTTP/S ports to the proxy itself, I'm using the following IPTABLES rules:
#!/bin/bash # Create new chain iptables -t nat -N SOCKSPROXY # Ignore LANs and some other reserved addresses. iptables -t nat -A SOCKSPROXY -d 0.0.0.0/8 -j RETURN iptables -t nat -A SOCKSPROXY -d 10.0.0.0/8 -j RETURN iptables -t nat -A SOCKSPROXY -d 127.0.0.0/8 -j RETURN iptables -t nat -A SOCKSPROXY -d 169.254.0.0/16 -j RETURN iptables -t nat -A SOCKSPROXY -d 172.16.0.0/12 -j RETURN iptables -t nat -A SOCKSPROXY -d 192.168.0.0/16 -j RETURN iptables -t nat -A SOCKSPROXY -d 22.214.171.124/4 -j RETURN iptables -t nat -A SOCKSPROXY -d 240.0.0.0/4 -j RETURN # Anything else should be redirected to port 1080 iptables -t nat -A SOCKSPROXY -p tcp -j REDIRECT --to-ports 1080 # Any tcp connection made by our user should be redirected iptables -t nat -A OUTPUT -p tcp -m owner --uid-owner $USER -j SOCKSPROXY # Accept all HTTP and HTTPS connections iptables -A INPUT -p tcp -m multiport --dports 80,443 -j ACCEPT iptables -A OUTPUT -p tcp -m multiport --dports 80,443 -j ACCEPT
But I'm seeing connection refused errors. Is iptables the right approach to forward the incoming connections to the proxy server? If so, what am I missing?