I have CentOS 7 on an OpenVZ VPS running OpenVPN, Privoxy, and CSF.

When redirecting OpenVPN's web traffic to Privoxy, with my current configuration, I can't reach the internet.

From my csfpre.sh:

iptables -A FORWARD -s -j ACCEPT
iptables -A FORWARD -i as0t0 -o venet0:0 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i venet0:0 -o as0t0 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -t nat -A PREROUTING -i as0t0 -p tcp -m multiport --dports 80,443 -j REDIRECT --to-ports 8118
iptables -t nat -A POSTROUTING -s -o venet0:0 -j MASQUERADE
iptables -A OUTPUT -o as0t0 -j ACCEPT

When I comment out the REDIRECT line, I can reach the internet while connected via OpenVPN.

I would like to redirect OpenVPN's web traffic to Privoxy and still be able to reach the internet.

Update: I removed the 443 port redirection so the REDIRECT line is now:

iptables -t nat -A PREROUTING -i as0t0 -p tcp --dport 80 -j REDIRECT --to-port 8118

This FIXED the issue!


To my recollection, Privoxy does not support https protocol in intercepting mode.

You can definitely intercept the unencrypted traffic. Probably you would have checked out following things. Can yo confirm the same?

  1. Ensure Privoxy is working. You can comment out the REDIRECT in iptables and configure your browser to use the proxy manually. If you can browse, your Privoxy installation is working correctly.

  2. Make sure you have the following entry in Privoxy configuration file.

accept-intercepted-requests 1

  • Thank you, I checked these things before I posted the question. Privoxy is working and blocking ads when the redirection line is commented out. – 5tarting-N0w Jan 25 '17 at 22:36

What you're asking doesn't make any sense. You cannot "filter OpenVPN's traffic through Privoxy" because OpenVPN traffic isn't HTTP/HTML. (You could proxy OpenVPN through Privoxy, but Privoxy wouldn't be able to examine the traffic; it would at best just blindly pass it through.)

You can filter HTTP traffic that's destined for routing via the OpenVPN tunnel through Privoxy, but that isn't what you're asking. If this is what you want, then your system should already do this for you unless you are deliberately avoiding Privoxy for such traffic.

  • Sorry my description didn't make sense. I edited my post to better reflect what I'm trying to do. – 5tarting-N0w Jan 25 '17 at 22:43

I edited the REDIRECT line from:

iptables -t nat -A PREROUTING -i as0t0 -p tcp -m multiport --dports 80,443 -j REDIRECT --to-ports 8118

to the following:

iptables -t nat -A PREROUTING -i as0t0 -p tcp --dport 80 -j REDIRECT --to-port 8118

Removing the https redirect fixed the issue.

  • After switching to http only, did it work? – fossil Jan 26 '17 at 0:58
  • Please accept the answer. It may be useful for future users. – fossil Jan 26 '17 at 3:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.