I use a VPN under SSL solution (Firepass) on Android. VPN opens an SSL connection on port 443 of remote VPN server.

My mobile carrier doesn't allow direct connections on port 443 but allow SSL connections through its HTTP CONNECT proxy.

I want to implement this scenario.

  • tun0 outgoing traffic on VPN server TCP port 443 should be redirected, via iptables, on another port on lo.

  • redsocks listening on this port, configured in order to redirect connection on HTTP CONNECT proxy.

Also IP address of HTTP proxy server should be routed on rmnet0 network interface and other traffic on tun0.

  • ATM, I have configured redsocks in order to do http-connect and listening on port 8124. I have a rule like this: iptables -t nat -A OUTPUT --dport 443 -j REDIRECT --to-port 8124. VPN client login and VPN starts but I see only packet transmitted and none received. – osidovich Mar 25 '14 at 13:40
  • You have to configure the VPN end point somewhere, don't you? Why not simply change that to the redsocks port? Redirection from real interfaces to lo is not easily possible. If you cannot change the configuration: Would it be OK to run redsocks on a normal interface, limit its accessibility with iptables and redirect the traffic there? – Hauke Laging Mar 25 '14 at 15:52
  • @hauke-laging I can't change VPN configuration. I can bind redsocks on but I can't REDIRECT with iptables (redirection works only on local addresses). Investigating with netstat I see tcp connection to VPN server in ENSTABILISHED state but I can't receive back any packet from tun0 – osidovich Mar 25 '14 at 15:59
  • @osidovich Sorry, REDIRECT is not affected by this problem, no need to change to Can you inspect the traffic on the other side of the tunnel? – Hauke Laging Mar 25 '14 at 16:06
  • @hauke-laging No, I can't inspect the traffic on the other side of the tunnel – osidovich Mar 25 '14 at 16:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.