| View previous topic :: View next topic |
| Author |
Message |
biatch0
n00b
Joined: 25 May 2004
Posts: 40
|
 Posted: Wed Dec 12, 2007 12:35 am Post subject: Redirecting SSH tunnel data via iptables |
 |
|
This is my current setup at home:
[Windows Userbox] --- [VMWare Gentoo Proxy] -- [INTERNET] --- [Target Server]
In this current setup, I merely add a static route to my Gentoo proxy since it's on the local network. On the Gentoo proxy, this is basically what I've done:
| Code: | iptables -t nat -A PREROUTING -p tcp -d target.server.ip --dport 3724 -j REDIRECT --to-ports 50000
socat -d -d -d TCP4-LISTEN:50000,nodelay,fork,reuseaddr,su=nobody TCP4:target.server.ip:3724,nodelay |
I did a simple "route add target.server.ip gateway vmware.proxy.ip" on Windows. iptables then catches the data bound for target.server.ip:3724 and redirects it locally to port 50000 where socat picks up the stream and modifies it before sending it out to the original source. The entire setup works perfectly.
I am now trying to implement this on my server which is sitting in a datacenter.
[Windows Userbox] --- [INTERNET] --- [Proxy Server] --- [Target Server]
I'm facing trouble getting iptables/socat to properly process the traffic I'm sending, which is currently either via a putty SSH tunnel... or directly to the server via dante-sockd. I'm fairly certain that the socat switches should work properly... so at the moment I'm quite certain that my iptables rule isn't catching the traffic and redirecting it as it should.
Does anyone have any idea what my iptables rule should look like or did I overlook something else? |
|
| Back to top |
|
 |
Hu
Administrator
Joined: 06 Mar 2007
Posts: 23062
|
| Posted: Wed Dec 12, 2007 4:21 am Post subject: |
|
|
| What are you trying to accomplish with the second configuration? Your traffic would already cross the Internet unencrypted to reach the proxy server. |
|
| Back to top |
|
|
biatch0
n00b
Joined: 25 May 2004
Posts: 40
|
| Posted: Wed Dec 12, 2007 9:28 am Post subject: |
|
|
(1) Disabling Nagle's algorithm.
(2) Enabling tcp-nodelay. |
|
| Back to top |
|
|
Hu
Administrator
Joined: 06 Mar 2007
Posts: 23062
|
| Posted: Thu Dec 13, 2007 3:14 am Post subject: |
|
|
| According to the manpage, those two options are the same thing. All you need to do is call setsockopt and enable TCP_NODELAY on the relevant socket(s). However, most applications that benefit from this already enable it, so you might make things worse if you go tampering with it. |
|
| Back to top |
|
|
|
Networking & Security
