/nft-transproxy

TCP/UDP transparent proxy with predefined bypass address set, using nftables `tproxy` target.

Primary LanguageShellDo What The F*ck You Want To Public LicenseWTFPL

nft-transproxy

TCP/UDP transparent proxy with predefined bypass address set, using nftables tproxy target.

convention

  • TPROXY target: 127.0.0.1:1080 and ::1:1080

  • reroute packet fwmark: 0x233

  • ip rule and route:

    # ip rule add fwmark 0x233 lookup 100
# ip route add local 0.0.0.0/0 dev lo table 100
# ip -6 rule add fwmark 0x233 lookup 100
# ip -6 route add local ::/0 dev lo table 100

    See also ExecStartPost and ExecStopPost in systemd service file.

installation

# git clone https://github.com/rocka/nft-transproxy.git /usr/local/lib/nft-transproxy
# ln -sf /usr/local/lib/nft-transproxy/systemd/tproxy-nft-ip-rule.service /etc/systemd/system/
# vim /usr/local/lib/nft-transproxy/scripts/make-direct-ipv{4,6}.sh # important! specify bypass IP (typically your proxy server)
# /usr/local/lib/nft-transproxy/scripts/make-direct-ipv{4,6}.sh # generate nft/direct-ipv{4,6}.nft
# systemctl enable --now tproxy-nft-ip-rule.service

todo

  • proxy packet from other host as gateway

references

iptables

nftables