So, here I have a basic setup with SOCKS5 proxy listening on, oh, say 8123

I redirect TCP to the proxy via iptables

From iptables perspective everything looks peachy, iptables -t nat -v -L shows

DNAT tcp -- any any anywhere anywhere to:127.0.01:8123

From the "practical" perspective it's working (Google's account activity, geoip websites and http://ipleak.net/ specifically are showing proxy's external IP)

So it would seem the proxy is working as intended.

However, if I try to do a netstat, I see things like

tcp 0 0 ESTABLISHED [browser's PID] is google.

What I would have expected netstat to show is the proxy's listening IP (localhost) instead of the remote server's (google's) IP.

Is the browser "leaking" past the iptable rule for some reason (and if so, why do google's account details show a connection from the proxy's external IP) ?

Or is it netstat being weird and oblivious to the fact that DNAT is taking place?


As far as your browser is concerned, it's connected to A DNAT doesn't change that fact. If you DNAT port 80 coming from the internet to port 80 on an internal webserver at e.g., would you expect netstat on the remote system to show as the remote IP or your external IP?

PS: is impossible, port numbers are 65535 or less (16 bits).

  • Okay, thanks for explaining, that makes sense. - and port number is a typo, of course – Lone_passerby May 7 '15 at 11:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.