I am using a transparent proxy to forward requests from a source (client) to a destination (server). I use iptables to make the transparent bit work... i.e: it makes the clients ip appear at the destination even though the request went through the intermediate proxy... it's called SSLH actually.. https://github.com/yrutschle/sslh
Here are the rules:
iptables -w -t mangle -N SSLH iptables -w -t mangle -A PREROUTING -p tcp -m socket --transparent -j SSLH iptables -w -t mangle -A OUTPUT --protocol tcp --out-interface eth0 -m multiport --sport 80,443,4480 --jump SSLH iptables -w -t mangle -A SSLH --jump MARK --set-mark 0x1 iptables -w -t mangle -A SSLH --jump ACCEPT ip rule add fwmark 0x1 lookup 100 ip route add local 0.0.0.0/0 dev lo table 100
I am running a website on apache on the same machine as the proxy, it's a Pi that's inside my home LAN.
When I try to access a website on that apache and the request originates from outside the lan... like if I connect to a wifi hotspot on my phone the page appears in the browser HOWEVER if I connect to my LAN wifi network and try to open the same page I get a timeout... UNLESS I disable those iptables rules... but when I do this requests that originate from outside the LAN timeout.
To possibly complicate things a bit I also use dnsmasq running on the same Pi to simulate NAT Loopback so I can access the website from within my own LAN using it's domain name and not just the local ip address.
If I just use the local ip address of the webserver it still won't work anyway.. unless I
Do I need to modify the iptables rules so that a web request like this:
Will bring up the page whether I'm outside or inside my LAN?