Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I'd like to send traffic destined to certain ip/subnet through one ssh socks5, while routing other traffic through another socks5 tunnel.

I'd tried tsocks with following configuration:

path {
        server = 127.0.0.1
        server_port = 3001
        server_type = 5
        reaches = 1.2.3.4/32
}

but then I try "tsocks wget 1.2.3.4" it doesn't go through that proxy giving an error IP (0.0.0.0) & 18:32:14 libtsocks(16065): SUBNET (0.0.0.0) != IP on line 33 in configuration file, ignored

I don't understand the error.

I'm also thinking if I can do this using iptables.

Any recommendations on how this can be done?

share|improve this question
add comment

2 Answers 2

You can use sshuttle as described in How do I route my internet through a SSH tunnel?

share|improve this answer
    
Simpler than redsocks and -v mode shows it setting up iptables for you. I wish there was a way to get -TN (no pseudo tty and no remote command) options working for the tunnel. –  Budric Aug 5 '12 at 1:32
add comment

I've also stumbled on redsocks solution to this http://darkk.net.ru/redsocks/

Essentially after you run your ssh tunnels and configure redsocks to connect to those tunnels you can add iptables:

# Create new chain
iptables -t nat -N REDSOCKS

# Do not route the following through redsocks
iptables -t nat -A REDSOCKS -d 0.0.0.0/8 -j RETURN
iptables -t nat -A REDSOCKS -d 10.0.0.0/8 -j RETURN
iptables -t nat -A REDSOCKS -d 127.0.0.0/8 -j RETURN
iptables -t nat -A REDSOCKS -d 169.254.0.0/16 -j RETURN
iptables -t nat -A REDSOCKS -d 172.16.0.0/12 -j RETURN
iptables -t nat -A REDSOCKS -d 224.0.0.0/4 -j RETURN
iptables -t nat -A REDSOCKS -d 240.0.0.0/4 -j RETURN
iptables -t nat -A REDSOCKS -d 192.168.0.0/16 -j RETURN
#exclude your ssh tunnels from being routed through redsocks...and themselves
iptables -t nat -I REDSOCKS -d tunnel_address1 -j RETURN 
iptables -t nat -I REDSOCKS -d tunnel_address2 -j RETURN 

#redirect set of addresses to one socks proxy running on port 30000
iptables -t nat -A REDSOCKS -p tcp -d 1.2.3.4 -j REDIRECT --to-ports 30000
#redirect another set of addresses to a different proxy
iptables -t nat -A REDSOCKS -p tcp -d 4.3.2.1 -j REDIRECT --to-ports 30001

#connect output to redsocks chain
iptables -t nat -A OUTPUT -p tcp -j REDSOCKS

This seems to work. I will try the sshuttle solution too as it seems a little simpler.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.