On the raspberry Pi, I install the privoxy and a socks proxy software.

I want to redirect all the traffic to the chain REDSOCKS_FILTER. The traffic of tcp protocol of port 80 from all the traffic will go through the privoxy and then to the chain REDSOCKS_FILTER. In the chain REDSOCKS_FILTER, I will discard some local ip address and finally the processed traffic go to the socks proxy software.

iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-ports 8118
iptables -t nat -A OUTPUT -p tcp --dport 8118  -j REDSOCKS_FILTER
iptables -t nat -A PREROUTING -p tcp -j REDSOCKS_FILTER

I try to write thease but the traffic of port 80 which go through privoxy cannot go to the REDSOCKS_FILTER chain. But if I type

iptables -t nat -A OUTPUT -p tcp --dport 8118  -j REDSOCKS_FILTER

It seems that it can't work from my test and still has the same result. I am puzzled for what mistake I have made.

1 Answer 1


I assume that REDSOCKS_FILTER is in the filter table of iptables, not in the nat table? You cannot jump from one table to another, as different tables are processed in different locations in the TCP/IP driver stack.

Since you're redirecting in the PREROUTING and OUTPUT chains in the NAT table, those changes are already applied when the packet gets processed by the respective INPUT and OUTPUT filter tables. So you'll need to something like this:

iptables -t filter -A INPUT -p tcp --dport 8118 -j REDSOCKS_FILTER
iptables -t filter -A OUTPUT -p tcp --dport 8118 -j REDSOCKS_FILTER

As filter is the default table, you can omit the -t filter option.

This diagram of the packet flow between the various Netfilter tables might be helpful:


Since you aren't doing bridging, everything you're doing with iptables happens within the green "Network Layer" in that image.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .