0

I'd like to send traffic destined to certain ip/subnet through one ssh socks5, while routing other traffic through another socks5 tunnel.

I'd tried tsocks with following configuration:

path {
        server = 127.0.0.1
        server_port = 3001
        server_type = 5
        reaches = 1.2.3.4/32
}

but then I try "tsocks wget 1.2.3.4" it doesn't go through that proxy giving an error IP (0.0.0.0) & 18:32:14 libtsocks(16065): SUBNET (0.0.0.0) != IP on line 33 in configuration file, ignored

I don't understand the error.

I'm also thinking if I can do this using iptables.

Any recommendations on how this can be done?

0

2 Answers 2

2

You can use sshuttle as described in How do I route my internet through a SSH tunnel?

1
  • Simpler than redsocks and -v mode shows it setting up iptables for you. I wish there was a way to get -TN (no pseudo tty and no remote command) options working for the tunnel.
    – Budric
    Aug 5, 2012 at 1:32
1

I've also stumbled on redsocks solution to this http://darkk.net.ru/redsocks/

Essentially after you run your ssh tunnels and configure redsocks to connect to those tunnels you can add iptables:

# Create new chain
iptables -t nat -N REDSOCKS

# Do not route the following through redsocks
iptables -t nat -A REDSOCKS -d 0.0.0.0/8 -j RETURN
iptables -t nat -A REDSOCKS -d 10.0.0.0/8 -j RETURN
iptables -t nat -A REDSOCKS -d 127.0.0.0/8 -j RETURN
iptables -t nat -A REDSOCKS -d 169.254.0.0/16 -j RETURN
iptables -t nat -A REDSOCKS -d 172.16.0.0/12 -j RETURN
iptables -t nat -A REDSOCKS -d 224.0.0.0/4 -j RETURN
iptables -t nat -A REDSOCKS -d 240.0.0.0/4 -j RETURN
iptables -t nat -A REDSOCKS -d 192.168.0.0/16 -j RETURN
#exclude your ssh tunnels from being routed through redsocks...and themselves
iptables -t nat -I REDSOCKS -d tunnel_address1 -j RETURN 
iptables -t nat -I REDSOCKS -d tunnel_address2 -j RETURN 

#redirect set of addresses to one socks proxy running on port 30000
iptables -t nat -A REDSOCKS -p tcp -d 1.2.3.4 -j REDIRECT --to-ports 30000
#redirect another set of addresses to a different proxy
iptables -t nat -A REDSOCKS -p tcp -d 4.3.2.1 -j REDIRECT --to-ports 30001

#connect output to redsocks chain
iptables -t nat -A OUTPUT -p tcp -j REDSOCKS

This seems to work. I will try the sshuttle solution too as it seems a little simpler.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .