Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a RPi with two interfaces, wlan0 and eth0. Through eth0 I have connected a set-top-box (STB): the network for eth0 is 192.168.2.0/24. My experiment is to use a transparent HTTP proxy (http://mitmproxy.org/) so that I can see the connections that the STB makes when I am browsing IPTV features.

wlan0 is on network 192.168.1.0/24 and is connected to my router. wlan0 is therefore internet connected.

I am stuck with configuring my Iptables rules such that I will be able to route all traffic sent over interface eth0 to the transparent proxy running on 192.168.1.7:8080.

So far I have:

iptables -A FORWARD -p ALL -i eth0 -o wlan0 -j ACCEPT
iptables -A FORWARD -i wlan0 -o eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
# Packet masquerading
#iptables -t nat -A POSTROUTING -o $LOCAL_IFACE -j MASQUERADE
iptables -t nat -A POSTROUTING -o wlan0 -j SNAT --to-source 192.168.1.7
# Packet redirection to MITMPROXY running on port 8080
iptables -t nat -A PREROUTING -s 192.168.2.0/24 -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080
iptables -t nat -A PREROUTING -s 192.168.2.0/24 -i eth0 -p tcp --dport 443 -j REDIRECT --to-port 8080
iptables -t nat -A PREROUTING -s 192.168.2.0/24 -i eth0 -p udp --dport 53 -j REDIRECT --to-port 8080

The transparent proxy does not display any connections, and my STB reports a generic connection error code.

Q: Am I making this difficult? I have arbitrarily decided that I should run the transparent proxy on the wlan0 network, however I can configure it to run on the same network as eth0... If I do the latter how will Linux take care of routing packets from the transparent proxy over wlan0 (and then to the internet) and back (for responses) without being obvious to the server on the internet that there's "something" in-between the STB and the server?...

I have been reading the following break-down http://www.karlrupp.net/en/computer/nat_tutorial, however I am confused by when to use the different variants of DNAT/SNAT and POST- and PREROUTING. I am still confused when to use FORWARDING too.

And my biggest concern is when these packets are being altered how does the kernel know when an incoming packet on wlan0 is actually a response to a request made on eth0 and intercepted by the transparent proxy? I guess what I am trying to say is the whole maintaining consistency for the network flow confuses me thus far.

All help will be greatly appreciated. ILMA

share|improve this question
    
Seriously. Nobody?.... –  I_lost_my_last_account Nov 14 '13 at 22:17

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.