1

If I have two Virtual Private Servers and they are located in different countries. Then I want to use one server (139.162.131.242) as a proxy server to proxy tcp and udp traffic, the proxy process listens on local port 8300. Another server (172.104.98.95) will be used to relay the traffic to the proxy server.

Someone taught me how to achieve this by using IPTABLES:
STEP 1: set up the proxy program on the proxy server (139.162.131.242) and run it
STEP 2: write a few iptables rules on the relay server (172.104.98.95), like this: 

iptables -t nat -A PREROUTING -p tcp --dport 8300 -j DNAT --to-destination 139.162.131.242:8300  
iptables -t nat -A PREROUTING -p udp --dport 8300 -j DNAT --to-destination 139.162.131.242:8300  
iptables -t nat -A POSTROUTING -d 139.162.131.242 -p tcp --dport 8300 -j SNAT --to-source 172.104.98.95  
iptables -t nat -A POSTROUTING -d 139.162.131.242 -p udp --dport 8300 -j SNAT --to-source 172.104.98.95

STEP 3: set up the proxy client program to make all tcp and udp traffic go to the relay server

But I am confused about this method. For example, I am playing a online game that use udp or tcp to communicate with the game server. When these traffic arrive the relay server, they will be DNATed and finally arrive the proxy server, but can the proxy server know where these traffic be sent to? I mean will the proxy server send these traffic to the game server? If it will, how can the proxy server know the real game server address after the destination address of the traffic has already been changed on the relay server?

Improve this question
0

1 Answer 1

Reset to default
1

The relevant information about IP packets are source address, destination address, source port and destination port. Source and destination port pair is used by the client and server: initiating side sends packet to destination port and chooses a source port, in a reply the source port is used as destination port and destination port as source port.

Each time when packet is altered the mapping between the changes is saved. This mapping is how the devices know what to do with the packets. NAT uses this information to map connections between hosts. Static NAT uses a mapping based on pre-configured rules, while dynamic NAT extends the map when a new connection starts and removes the map entry when the connection is closed.

I explain in steps how the packets travel between your client and server. Since I do not know the details about the proxy you are using, I assume all traffic to proxy is relayed to server and happens transparently.

The steps between your client and server:

client <---> VPN <---> NAT <---> proxy <---> server

From client to server:

  1. Client sends packet to destination address (proxy). Routing is used to send the traffic via VPN.
  2. NAT forwards the packet. NAT changes the source address to its own using by source NAT rule. destination address (proxy) is unchanged.
  3. Proxy gets packet from NAT, relays it as usual.
  4. Destination server receives packet from proxy.

From server to client:

  1. Destination server sends packet to proxy.
  2. Proxy relays the packet to NAT.
  3. NAT forwards the packet. Destination address is changed to your client's address by destination NAT rule. Source address (proxy) is unchanged.
  4. Your client receives the packet.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .