0
I am using a transparent proxy to forward requests from a source (client) to a destination (server). I use iptables to make the transparent bit work... i.e: it makes the clients ip appear at the destination even though the request went through the intermediate proxy... it's called SSLH actually.. https://github.com/yrutschle/sslh
Here are the rules:
iptables -w -t mangle -N SSLH
iptables -w -t mangle -A PREROUTING -p tcp -m socket --transparent -j SSLH
iptables -w -t mangle -A OUTPUT --protocol tcp --out-interface eth0 -m multiport --sport 80,443,4480 --jump SSLH
iptables -w -t mangle -A SSLH --jump MARK --set-mark 0x1
iptables -w -t mangle -A SSLH --jump ACCEPT
ip rule add fwmark 0x1 lookup 100
ip route add local 0.0.0.0/0 dev lo table 100
I am running a website on apache on the same machine as the proxy, it's a Pi that's inside my home LAN.
When I try to access a website on that apache and the request originates from outside the lan... like if I connect to a wifi hotspot on my phone the page appears in the browser HOWEVER if I connect to my LAN wifi network and try to open the same page I get a timeout... UNLESS I disable those iptables rules... but when I do this requests that originate from outside the LAN timeout.
To possibly complicate things a bit I also use dnsmasq running on the same Pi to simulate NAT Loopback so I can access the website from within my own LAN using it's domain name and not just the local ip address.
If I just use the local ip address of the webserver it still won't work anyway.. unless I
Do I need to modify the iptables rules so that a web request like this:
https://www.example.com/test.html
Will bring up the page whether I'm outside or inside my LAN?
Thank you,
Flex
Why are you marking source ports rather then destination ones in line 3? Also,I font see how you are intercepting and redirecting requests - It would seem to me that your last line is redirecting traffic out the LI interface, but not rewriting the target so I dont see how it cab work (but im on holiday, and may be missing the obvious) – davidgo – 2019-07-19T05:37:59.680
That's an output chain so it applies to packets that are leaving processes on the host.. like a web server... hence source port. In this set up I don't need to rewrite packets.. I mark them and route the marked ones to localhost so they get routed back to where they came from. I don't fully understand it myself but it does work as a transparent proxy. I don't need help with that I need help understanding why I get a timeout when those rules are in place and the request originates from within my LAN but it works fine when the request originates from outside on the internet. Cheers. – FlexMcMurphy – 2019-07-20T12:31:28.923