3

I've set up polipo on my machine to listen to the default port 8123. To test it, I set the in-memory cache to a ridiculously high 2 GB and downloaded a 50 MB file using wget utilizing the proxy.

http_proxy='http://localhost:8123' wget server/file

As expected, the first execution needs some seconds to transfer the file. Subsequent repetitions utilize caching and complete in less than a second.

Now, I want to try directing all HTTP (port 80) traffic to be automatically routed through polipo, so that I don't have to specify the proxy with each web browser, mail client or other program I use. Although the faq indeed states that polipo is not intended for this use case, the Arch Linux Wiki mentions to do this via iptables

iptables -t nat -A OUTPUT -p tcp --dport 80 -m owner ! --uid-owner polipo -j ACCEPT
iptables -t nat -A OUTPUT -p tcp --dport 80 -j REDIRECT --to-ports 8123

After executing these commands as root, I again issue the wget command without the proxy environment variable set. All invocations need to download the file again, caching is not utilized, which is also reflected by

$ iptables -t nat -vL
[...]
Chain OUTPUT (policy ACCEPT 5 packets, 529 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    6   312 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp dpt:http ! owner UID match polipo
    0     0 REDIRECT   tcp  --  any    any     anywhere             anywhere             tcp dpt:http redir ports 8123
[...]

Only the ACCEPT rule is triggered, not the REDIRECT directive. I also tried to reverse the filter. Note the missing negation !.

iptables -t nat -R OUTPUT 1 -p tcp --dport 80 -m owner --uid-owner polipo -j ACCEPT

Thereafter, only the second rule was utilized, redirecting all HTTP traffic to always return the polipo configuration interface.

How do I configure iptables correctly to route HTTP traffic through polipo? Is it even possible? Or do I have to switch to the more heavyweight squid?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.