Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to lead some traffic through a transparent proxy (which actually is on another server and connected with an ssh tunnel).

Normally I could do this:

ipfw add forward localhost,8080 tcp from any to x.x.x.x 80

However, fwd/forward needs a re-compile of the kernel, which I am not happy to do. Therefore, I'm searching for a solution that doesn't need a recompile.

For example, could I somehow use a divert socket to implement this? Or are there any other basic good solutions?

share|improve this question
ipfw divert requires as well to re-compile your kernel. Why being to unhappy about this ? – Ouki Mar 5 '12 at 12:54
@Ouki No, ipfw divert can be loaded as module (ipdivert_load="YES" in loader.conf) – Peter Smit Mar 5 '12 at 12:57

No, you can't. divert can be used only with software that listens on sockets created with IPPROTO_IPDIVERT, but proxy servers usually listen on TCP ports.

Have you tried to use another firewalls for this purpose? http://wiki.squid-cache.org/SquidFaq/InterceptionProxy#Interception_Caching_packet_redirection_for_Solaris.2C_SunOS.2C_and_BSD_systems

share|improve this answer

I recently had a look on rinetd (~ports/net/rinetd).

This is a very simple port redirector (from one ip/port to another). The re-direction is done through its configuration file rinted.conf:

# bindadress    bindport  connectaddress  connectport         8080         80 

Divert is usually used for more wide port selections (ie like all from 1 interface to natd ;).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.