{"action":"created","issue":{"url":"https://api.github.com/repos/darkk/redsocks/issues/65","labels_url":"https://api.github.com/repos/darkk/redsocks/issues/65/labels{/name}","comments_url":"https://api.github.com/repos/darkk/redsocks/issues/65/comments","events_url":"https://api.github.com/repos/darkk/redsocks/issues/65/events","html_url":"https://github.com/darkk/redsocks/issues/65","id":100871256,"number":65,"title":"Redsocks doesn't work with the ssh -D command","user":{"login":"hillz1","id":11052416,"avatar_url":"https://avatars.githubusercontent.com/u/11052416?v=3","gravatar_id":"","url":"https://api.github.com/users/hillz1","html_url":"https://github.com/hillz1","followers_url":"https://api.github.com/users/hillz1/followers","following_url":"https://api.github.com/users/hillz1/following{/other_user}","gists_url":"https://api.github.com/users/hillz1/gists{/gist_id}","starred_url":"https://api.github.com/users/hillz1/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hillz1/subscriptions","organizations_url":"https://api.github.com/users/hillz1/orgs","repos_url":"https://api.github.com/users/hillz1/repos","events_url":"https://api.github.com/users/hillz1/events{/privacy}","received_events_url":"https://api.github.com/users/hillz1/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-08-13T21:18:00Z","updated_at":"2015-08-14T09:17:09Z","closed_at":null,"body":"I use this ssh tunnel command to create a socks proxy on my openwrt router with the IP of 192.168.1.1:\r\n\r\nssh -o \"ProxyCommand corkscrew 127.0.0.1 3339 %h %p\" -vND 1080 username@serverip\r\n\r\nand this is my redsocks.conf:\r\n\r\n```\r\nbase {\r\n        // debug: connection progress & client list on SIGUSR1\r\n        log_debug = on;\r\n\r\n        // info: start and end of client session\r\n        log_info = on;\r\n\r\n        /* possible `log' values are:\r\n         *   stderr\r\n         *   file:/path/to/file\r\n         *   syslog:FACILITY  facility is any of \"daemon\", \"local0\"...\"local7\"\r\n         */\r\n        log = stderr;\r\n\r\n        // detach from console\r\n        daemon = off;\r\n\r\n        /* Change uid, gid and root directory, these options require root\r\n         * privilegies on startup.\r\n         * Note, your chroot may requre /etc/localtime if you write log to syslog.\r\n         * Log is opened before chroot & uid changing.\r\n         */\r\n        // user = nobody;\r\n        // group = nobody;\r\n        // chroot = \"/var/chroot\";\r\n\r\n        /* possible `redirector' values are:\r\n         *   iptables   - for Linux\r\n         *   ipf        - for FreeBSD\r\n         *   pf         - for OpenBSD\r\n         *   generic    - some generic redirector that MAY work\r\n         */\r\n        redirector = iptables;\r\n}\r\n\r\nredsocks {\r\n        /* `local_ip' defaults to 127.0.0.1 for security reasons,\r\n         * use 0.0.0.0 if you want to listen on every interface.\r\n         * `local_*' are used as port to redirect to.\r\n         */\r\n        local_ip = 0.0.0.0;\r\n        local_port = 12345;\r\n\r\n        // `ip' and `port' are IP and tcp-port of proxy-server\r\n        ip = 127.0.0.1;\r\n        port = 1080;\r\n\r\n\r\n        // known types: socks4, socks5, http-connect, http-relay\r\n        type = socks5;\r\n\r\n        // login = \"foobar\";\r\n        // password = \"baz\";\r\n}\r\n\r\nredudp {                                                         \r\n        // `local_ip' should not be 0.0.0.0 as it's also used for outgoing\r\n        // packets that are sent as replies - and it should be fixed      \r\n        // if we want NAT to work properly.                               \r\n        local_ip = 127.0.0.1;                                             \r\n        local_port = 10053;                                               \r\n\r\n        // `ip' and `port' of socks5 proxy server.                        \r\n        ip = 127.0.0.1;                                                   \r\n        port = 1080;                                                      \r\n        //login = username;                                               \r\n        //password = pazzw0rd;                                            \r\n\r\n        // kernel does not give us this information, so we have to duplicate it\r\n        // in both iptables rules and configuration file.  By the way, you can \r\n        // set `local_ip' to 127.45.67.89 if you need more than 65535 ports to \r\n        // forward ;-)                                                         \r\n        // This limitation may be relaxed in future versions using contrack-tools.\r\n        dest_ip = 8.8.8.8;                                                        \r\n        dest_port = 53;                                                           \r\n\r\n        udp_timeout = 30;                                                         \r\n        udp_timeout_stream = 180;                                                 \r\n}                                                                                 \r\n\r\n// you can add more `redsocks' and `redudp' sections if you need.\r\n```\r\n\r\nHow can I use redsocks to redirect my internet traffic to that ssh tunnel ? I want it to be like openvpn where I can just connect to my wifi and browse the internet, with ssh tunnel I have to set the proxy to socks port 1080 on the client side every time I want to redirect all my internet traffic to that tunnel. I'm new to linux and I'm stuck at the iptables command, I have read the instructions at http://darkk.net.ru/redsocks/ but I still can't get it to work. Here's the commands I use:\r\n\r\n```\r\niptables -t nat -N REDSOCKS\r\niptables -t nat -A REDSOCKS -d 192.168.0.0/16 -j RETURN\r\niptables -t nat -A REDSOCKS -d 127.0.0.0/8 -j RETURN\r\niptables -t nat -A REDSOCKS -p tcp -j DNAT --to-destination 127.0.0.1:12345\r\niptables -t nat -I OUTPUT 1 -p tcp -j REDSOCKS\r\niptables -t nat -I PREROUTING 1 -p tcp -s 192.168.1.0/22 -j REDSOCKS\r\n```\r\n\r\nPlease tell me where I went wrong."},"comment":{"url":"https://api.github.com/repos/darkk/redsocks/issues/comments/131038069","html_url":"https://github.com/darkk/redsocks/issues/65#issuecomment-131038069","issue_url":"https://api.github.com/repos/darkk/redsocks/issues/65","id":131038069,"user":{"login":"darkk","id":21046,"avatar_url":"https://avatars.githubusercontent.com/u/21046?v=3","gravatar_id":"","url":"https://api.github.com/users/darkk","html_url":"https://github.com/darkk","followers_url":"https://api.github.com/users/darkk/followers","following_url":"https://api.github.com/users/darkk/following{/other_user}","gists_url":"https://api.github.com/users/darkk/gists{/gist_id}","starred_url":"https://api.github.com/users/darkk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/darkk/subscriptions","organizations_url":"https://api.github.com/users/darkk/orgs","repos_url":"https://api.github.com/users/darkk/repos","events_url":"https://api.github.com/users/darkk/events{/privacy}","received_events_url":"https://api.github.com/users/darkk/received_events","type":"User","site_admin":false},"created_at":"2015-08-14T09:17:08Z","updated_at":"2015-08-14T09:17:08Z","body":"> How can I use redsocks to redirect my internet traffic to that ssh tunnel\r\n\r\nYou should probably use `REDIRECT` instead of `DNAT`.\r\n\r\n> I want it to be like openvpn\r\n\r\nThat's (strictly speaking) impossible. `openvpn` works at MAC or IP layer and `redsocks` works at TCP layer. Moreover, `redsocks`+`ssh` will encapsulate several TCP streams to single ssh stream, and it may be bad for latency due to [Head-of-line blocking](https://en.wikipedia.org/wiki/Head-of-line_blocking).\r\n\r\nBut it should work **a-bit-like** openvpn if you can tolerate the latency."}}