I have a Raspberry Pi which establishes an SSH connection to a remote server (VPS) and opens a port on the Pi so I can use it as a SOCKS5 proxy. This is the command I use to establish the tunnel:

ssh -D 1080 -f -C -q -N user@hostname

The reason for this is that the network blocks VPN using DPI but not SSH. So I have setup a VPN on the LAN and setup a SOCKS5 proxy (same Pi). The problem is, if the proxy is down, then the VPN outbound traffic (so where it is no longer VPN traffic but just regular HTTP(S)) will not use it and attempt to send those requests through the network firewall anyway. I want to stop this from happening so that if the proxy is down, the VPN will not allow any connection outbound.

This shows you how it is supposed to work

                       |                              |
                       |            Client            |
                                       | L2TP over IPSEC
                       ________________|_______________ __ 
                      |                                |  |
                      |       VPN (192.168.1.XXX)      |  |
                      |________________________________|  |
                       ________________|_______________   |-RaspberryPi
                      |                                |  | 
                      |    SOCKS5 (     |  |
                                       | SSH tunnel
                      |                                 |
                      |         VPS (Amazon EC2)        |
                                      / \
                                     /   \
                                  the internet 

These are my iptables:

-A POSTROUTING -s -o eth+ -m policy --dir out --pol none -j MASQUERADE
-A INPUT -p udp -m udp --dport 1701 -m policy --dir in --pol none -j DROP
-A INPUT -m conntrack --ctstate INVALID -j DROP
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p udp -m multiport --dports 500,4500 -j ACCEPT
-A INPUT -p udp -m udp --dport 1701 -m policy --dir in --pol ipsec -j ACCEPT
-A INPUT -p udp -m udp --dport 1701 -j DROP
-A FORWARD -m conntrack --ctstate INVALID -j DROP
-A FORWARD -i eth+ -o ppp+ -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i ppp+ -o eth+ -j ACCEPT
-A FORWARD -s -d -i ppp+ -o ppp+ -j ACCEPT
-A FORWARD -d -i eth+ -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s -o eth+ -j ACCEPT

This was the script used to make the VPN https://github.com/hwdsl2/setup-ipsec-vpn

So my question is: How can I change these iptables to force the VPN clients to only use a SOCKS5 proxy on the LAN? (otherwise DROP their non-proxy destined packets)

  • -D does not create Tunnel, but a SOCK5 proxy. To allow data flow from VPN to SOCKS you need some application that will rewrite data into that format and vice versa on the way back.
    – Jakuje
    Apr 4 '17 at 6:21
  • Hi. Thanks for that but I can configure the VPN client to use the local proxy instead. However, I would like to block anything outbound that doesn't use the socks proxy. What iptable chain do I need to modify given the above configuration? Apr 4 '17 at 6:45
  • Your problem is that you are forwarding traffic, but the socks server is a local process so if you can stop forwarding you'll get what you want.
    – xae
    Apr 12 '17 at 16:10
  • @xae, you mean not using socks server?
    – thinkmore
    Jan 20 '20 at 10:12

What you're looking for is called a transparent proxy. Transparent proxies are intended to be placed on gateways, but they don't have to be; so long as packets get routed through a node (as they are in your example), you can use iptables on that node to REDIRECT their traffic to whatever process on that node is handling proxies for you.

A quick search for "transparent socks proxy" on Google turns up something called redsocks. You might give that a try; you'll be running your ssh SOCKS5 session and redsocks instance on the same node, with redsocks passing traffic into ssh. Instructions on the linked site look reasonably complete for getting you going.

  • Thanks but I've already tried that and I couldn't get it to work because I don't know which iptable rules to remove from the script for the VPN setup Apr 13 '17 at 10:08
  • That's information that should be in the question. Apr 13 '17 at 10:17
  • It's in the question as I'm asking how these specific iptables should be changed to allow for forwarding of all the VPN traffic to REDSOCKS Apr 13 '17 at 10:19
  • No, the question presently doesn't contain a translation mechanism between raw IP and SOCKS5. Regardless, the rule you need to change to REDIRECT is the one that reads -i ppp+ -o eth+; that's the one that operates on traffic routing from your VPN (ppp+) to to anywhere else. Apr 13 '17 at 10:23
  • So I would delete it and then change it to -A FORWARD -i ppp+ -o eth+ -j REDIRECT --to-port 12345???? Apr 13 '17 at 10:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.