I want to set a linux (mint/ubuntu) client to use Redoscks to pass all tcp and udp connexions to a SOCKS5 proxy server running Dante, on a single port, to pass through an enterprise proxy. So far I have success redirecting HTTP/HTTPS at home (so without the restrictive enterprise proxy in between), and tests seem to show partial success with UDP. I want to ensure full TCP and UDP redirect so all services, like ntp, could run. DNS request redirect would be good too.
The dante config file is as follow, set to allow udp associate, with basic user authentication.
# /etc/danted.conf logoutput: syslog user.privileged: root user.unprivileged: nobody internal: veth0 port=1080 external: veth0 socksmethod: username clientmethod: none # Rules client pass { from: 0.0.0.0/0 to: 0.0.0.0/0 log: error connect disconnect } client block { from: 0.0.0.0/0 to: 0.0.0.0/0 log: connect error } socks pass { from: 0.0.0.0/0 to: 0.0.0.0/0 command: bind connect udpassociate log: error connect disconnect socksmethod: username } socks block { from: 0.0.0.0/0 to: 0.0.0.0/0 log: connect error } socks pass { from: 0.0.0.0/0 to: 0.0.0.0/0 command: bindreply udpreply log: error # connect disconnect iooperation } For cleanliness sake as I draw inspiration from templates, I don't really understand the need for the client block and socks block rules. They don't seem to change anything if commented out. I also don't get why to put back socksmethod:username in the socks pass rule if defined globally. Commenting it out has no effect.
On the client, the redsocks config files reads as follow
base { log_debug = off; log_info = on; log = "syslog:daemon"; daemon = on; user = redsocks; group = redsocks; redirector = iptables; } redsocks { local_ip = 127.0.0.1; local_port = 12345; ip = myproxyserverIP; port = 1080; type = socks5; login = myproxyuser; password = myproxypassword; } redudp { local_ip = 127.0.0.1; local_port = 12345; ip = myproxyserverip; port = 1080; login = myproxyuser; password = myproxypassword; dest_ip = 8.8.8.8; dest_port = 53; udp_timeout = 30; udp_timeout_stream = 180; } dnstc { // fake and really dumb DNS server that returns "truncated answer" to // every query via UDP, RFC-compliant resolver should repeat same query // via TCP in this case. local_ip = 127.0.0.1; local_port = 5300; } I then use iptables to redirect 80 and 443 to redsocks, both in TCP and UDP. I also add UDP 5002 for the iperf test server.
*nat :PREROUTING ACCEPT [26:3850] :INPUT ACCEPT [2:178] :OUTPUT ACCEPT [8:3456] :POSTROUTING ACCEPT [10:6452] :REDSOCKS - [0:0] -A PREROUTING -p tcp -m tcp --dport 443 -j REDSOCKS -A PREROUTING -p tcp -m tcp --dport 80 -j REDSOCKS -A PREROUTING -p udp -m udp --dport 443 -j REDSOCKS -A PREROUTING -p udp -m udp --dport 80 -j REDSOCKS -A PREROUTING -p udp -m udp --dport 5002 -j REDSOCKS -A OUTPUT -p tcp -m tcp --dport 443 -j REDSOCKS -A OUTPUT -p tcp -m tcp --dport 80 -j REDSOCKS -A OUTPUT -p udp -m udp --dport 443 -j REDSOCKS -A OUTPUT -p udp -m udp --dport 80 -j REDSOCKS -A OUTPUT -p udp -m udp --dport 5002 -j REDSOCKS -A REDSOCKS -d 0.0.0.0/8 -j RETURN -A REDSOCKS -d 10.0.0.0/8 -j RETURN -A REDSOCKS -d 127.0.0.0/8 -j RETURN -A REDSOCKS -d 169.254.0.0/16 -j RETURN -A REDSOCKS -d 172.16.0.0/12 -j RETURN -A REDSOCKS -d 192.168.0.0/16 -j RETURN -A REDSOCKS -d 224.0.0.0/4 -j RETURN -A REDSOCKS -d 240.0.0.0/4 -j RETURN -A REDSOCKS -p tcp -j REDIRECT --to-ports 12345 -A REDSOCKS -p udp -j REDIRECT --to-ports 12345 COMMIT *filter :INPUT ACCEPT [4510:4209873] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [6689:7022488] COMMIT From then on, it seems to work. Browsing the internet works, if I
curl ifconfig.co I get the proxy server address.
If I try to test the udp connexion,
iperf -c speedtest.serverius.net -u -p 5002 and try to look at active udp connexions (though stateless)
ss -u -pa I see that there is a udp connexion to my proxy server, though they are reported at ports 48066 and 48610, not 1080. I also see a direct connexion to the serverius test server, port indicated rfe? Could someone explain this to me?
If I try to be a bit more brutal, and tell iptables to route all traffic, nothing works anymore, I get no connexion ton anything. I must be doing something very wrong.
*nat :PREROUTING ACCEPT [26:3850] :INPUT ACCEPT [2:178] :OUTPUT ACCEPT [8:3456] :POSTROUTING ACCEPT [10:6452] :REDSOCKS - [0:0] -A PREROUTING -p tcp -m tcp -j REDSOCKS -A PREROUTING -p udp -m udp -j REDSOCKS -A OUTPUT -p tcp -m tcp -j REDSOCKS -A OUTPUT -p udp -m udp -j REDSOCKS -A REDSOCKS -d 0.0.0.0/8 -j RETURN -A REDSOCKS -d 10.0.0.0/8 -j RETURN -A REDSOCKS -d 127.0.0.0/8 -j RETURN -A REDSOCKS -d 169.254.0.0/16 -j RETURN -A REDSOCKS -d 172.16.0.0/12 -j RETURN -A REDSOCKS -d 192.168.0.0/16 -j RETURN -A REDSOCKS -d 224.0.0.0/4 -j RETURN -A REDSOCKS -d 240.0.0.0/4 -j RETURN -A REDSOCKS -p tcp -j REDIRECT --to-ports 12345 -A REDSOCKS -p udp -j REDIRECT --to-ports 12345 COMMIT *filter :INPUT ACCEPT [4510:4209873] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [6689:7022488] COMMIT Your help would be greatly appreciated, my brain is melting :p Thank you, Nicolas
11 Answer
In dante config, I think you blocked all connections as in
client block { from: 0.0.0.0/0 to: 0.0.0.0/0 log: connect error } 
