So, here I have a basic setup with SOCKS5 proxy listening on, oh, say 8123
I redirect TCP to the proxy via
iptables perspective everything looks peachy,
iptables -t nat -v -L shows
DNAT tcp -- any any anywhere anywhere to:127.0.01:8123
From the "practical" perspective it's working (Google's account activity, geoip websites and http://ipleak.net/ specifically are showing proxy's external IP)
So it would seem the proxy is working as intended.
However, if I try to do a
netstat, I see things like
tcp 0 0 10.201.87.64:59949 220.127.116.11:443 ESTABLISHED [browser's PID]
18.104.22.168:443 is google.
What I would have expected
netstat to show is the proxy's listening IP (localhost) instead of the remote server's (google's) IP.
Is the browser "leaking" past the
iptable rule for some reason (and if so, why do google's account details show a connection from the proxy's external IP) ?
Or is it
netstat being weird and oblivious to the fact that DNAT is taking place?