Is it possible to set up a server which acts as a proxy that is able to delegate all incoming traffic (regardless of protocol) to the original destination?

What I am trying to do is to allow only a single outgoing address to the internet from a VM that is hosted in a network. The VM would run aptitude updates or download pip and npm packages and require requests beyond just HTTP or FTP which is why I ask for a low-level UDP/TCP proxy. The proxy server would most likely run Ubuntu. Is this something iptables can be set up to do, and if so, how would it know where to delegate the traffic from the VM to? Or is this something a VPN could be used for?

I'd appreciate any kind of ideas (incomplete or not) or pointers in a direction to investigate. The premise of having only allowing one (or at least "few") outgoing connection is not my idea, but a 3rd party requirement which I unfortunately don't have control over.

  • I am not sure what you are asking for, but it might be that you want NAT. Typical residential routers running NAT are doing the translation of the addresses of multiple machines to a single one for all tcp and udp traffic. Typically this is just set up for traffic that originates from one of the local machines bit that seems consistent with your requirements. This is something that iptables can set up. The boubt I have is that the typical VM would only have 1 IPv4 address ignoring loopback addresses.
    – icarus
    Jul 12, 2021 at 3:19
  • NAT seems what I want to do. Can iptables be set up in a way that it operates on a separate server (not the VM the request originates from, but the "proxy server")?
    – orange
    Jul 12, 2021 at 3:31
  • @orange: What you ask is actually a very common setup: host systems provides internet connectivity for all VM on the host using NAT. It is usually even build into the VM environment, for example by choosing NAT as the type for the network adapter in virt-manager. It is not clear for me how your requirement differs from what is already offered by VM environments by default. Jul 12, 2021 at 4:56
  • 1
    The NAT configuration must be setup on the "proxy server". The only configuration on the VM would be to tell it that all traffic needs to be routed via the proxy server machine.
    – icarus
    Jul 12, 2021 at 7:09
  • @SteffenUllrich I realise now that I am looking for NAT. The difference to a built-in NAT in the virtual network adapter is that I'd like to set up the NAT separate from the VM (under my control as opposed to under the control of the VM admin). In fact, the use of the term "VM" is confusing. We may as well refer to it as a computer within a network which is meant to have only 1 outgoing connection to another host and still be able to run apt, pip and npm (and potentially others).
    – orange
    Jul 12, 2021 at 8:38


You must log in to answer this question.

Browse other questions tagged .