When connected via OpenVPN to my VPS, how can I redirect web traffic to Privoxy

Question

I have CentOS 7 on an OpenVZ VPS running OpenVPN, Privoxy, and CSF.

When redirecting OpenVPN's web traffic to Privoxy, with my current configuration, I can't reach the internet.

From my csfpre.sh:

iptables -A FORWARD -s 172.27.1.0/24 -j ACCEPT
iptables -A FORWARD -i as0t0 -o venet0:0 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i venet0:0 -o as0t0 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -t nat -A PREROUTING -i as0t0 -p tcp -m multiport --dports 80,443 -j REDIRECT --to-ports 8118
iptables -t nat -A POSTROUTING -s 172.27.1.0/24 -o venet0:0 -j MASQUERADE
iptables -A OUTPUT -o as0t0 -j ACCEPT

When I comment out the REDIRECT line, I can reach the internet while connected via OpenVPN.

I would like to redirect OpenVPN's web traffic to Privoxy and still be able to reach the internet.

---

Update: I removed the 443 port redirection so the REDIRECT line is now:

iptables -t nat -A PREROUTING -i as0t0 -p tcp --dport 80 -j REDIRECT --to-port 8118

This FIXED the issue!

Answer 1

To my recollection, Privoxy does not support https protocol in intercepting mode.

You can definitely intercept the unencrypted traffic. Probably you would have checked out following things. Can yo confirm the same?

1. Ensure Privoxy is working. You can comment out the REDIRECT in iptables and configure your browser to use the proxy manually. If you can browse, your Privoxy installation is working correctly.

2. Make sure you have the following entry in Privoxy configuration file.

accept-intercepted-requests 1

Answer 2

What you're asking doesn't make any sense. You cannot "filter OpenVPN's traffic through Privoxy" because OpenVPN traffic isn't HTTP/HTML. (You could proxy OpenVPN through Privoxy, but Privoxy wouldn't be able to examine the traffic; it would at best just blindly pass it through.)

You can filter HTTP traffic that's destined for routing via the OpenVPN tunnel through Privoxy, but that isn't what you're asking. If this is what you want, then your system should already do this for you unless you are deliberately avoiding Privoxy for such traffic.

Answer 3

I edited the REDIRECT line from:

iptables -t nat -A PREROUTING -i as0t0 -p tcp -m multiport --dports 80,443 -j REDIRECT --to-ports 8118

to the following:

iptables -t nat -A PREROUTING -i as0t0 -p tcp --dport 80 -j REDIRECT --to-port 8118

Removing the https redirect fixed the issue.