<div dir="ltr">I just wanted to follow up that post showing my full set of rules. See below: <br><br>*filter<br>:INPUT DROP [0:0]<br>:FORWARD DROP [0:0]<br>:OUTPUT DROP [0:0]<br>:LOGGING - [0:0]<br><br>-A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT<br>-A INPUT -j LOG --log-prefix "All Input"<br>-A INPUT -i eth0 -p tcp --dport 443 -j ACCEPT<br>-A INPUT -i eth0 -p udp --sport 53 -j ACCEPT<br>-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT<br>#-A INPUT -i eth0 -p icmp -m icmp --icmp-type echo-request -j DROP <br>#-A INPUT -i eth0 -j InputIP <br>-A INPUT -i lo -j ACCEPT<br>-A INPUT -j LOG --log-prefix "INPUT-Drop:"<br>-A INPUT -j DROP<br><br>-A FORWARD -j LOG --log-prefix "All-Forwards"<br>-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT<br>-A FORWARD -j LOG --log-prefix "FORWARD-Drop:"<br>-A FORWARD -j DROP<br><br>-A OUTPUT -o eth0 -p tcp --sport 22 -j ACCEPT<br>-A OUTPUT -j LOG --log-prefix "All Output"<br>-A OUTPUT -o eth0 -p tcp --sport 443 -j ACCEPT<br>-A OUTPUT -o eth0 -p udp --dport 53 -j ACCEPT<br>-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT<br>-A OUTPUT -o lo -j ACCEPT<br>-A OUTPUT -o eth0 -p tcp --dport 8999 -j ACCEPT<br>-A OUTPUT -o eth0 -p tcp --dport 8000 -j ACCEPT<br>-A OUTPUT -j LOG --log-prefix "OUTPUT-Drop:"<br>-A OUTPUT -j DROP<br><br>COMMIT<br><br><br>*nat<br>:PREROUTING ACCEPT [0:0]<br>:OUTPUT ACCEPT [0:0]<br>:POSTROUTING ACCEPT [0:0]<br>-A PREROUTING -j LOG<br>-A PREROUTING -p tcp --dport 12345 -i eth0 -j DNAT --to-destination <a href="http://127.0.0.1:9040">127.0.0.1:9040</a><br><br>COMMIT<br><br>*mangle<br>:PREROUTING ACCEPT [0:0]<br>:INPUT ACCEPT [0:0]<br>:FORWARD ACCEPT [0:0]<br>:OUTPUT ACCEPT [0:0]<br>:POSTROUTING ACCEPT [0:0]<br>COMMIT<br><br></div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Oct 28, 2014 at 5:31 PM, Derek Cole <span dir="ltr"><<a href="mailto:derek.cole@gmail.com" target="_blank">derek.cole@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div>Hello,<br><br>Regarding that IPtables line that is mentioned in the manpage - what is the redirected port? <br><span class=""><br>
/sbin/iptables -t nat -I PREROUTING -p tcp --dport <redirected_port> \
-i eth0 -j DNAT --to-destination <local_ip>:<stunnel_port><br><br></span></div>I am using the stunnel configuration I posted in the first email, and I want traffic on the stunnel server to end up at localhost:9040 so I think I would use that as the --to-destination, but I am unsure what to put in the --dport. Is that going to be any port that I may be connecting to transparently (i.e. if I am using this as a web browser, would it be 80, 8000, 8080, etc?)<br></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Oct 23, 2014 at 12:13 PM, Derek Cole <span dir="ltr"><<a href="mailto:derek.cole@gmail.com" target="_blank">derek.cole@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div>Thanks for the reply. Is this the normal way people would do this, or would you normally just run an stunnel in client mode on that server, and have firefox connect to it, which would then be able to transparently proxy to the internet? <br><br></div>Or is it pretty much always necessary to be running some actual proxy software, regardless whether stunnel is in client or server mode?<br><br><br></div><div><div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Oct 23, 2014 at 11:26 AM, Suresh Ramasamy <span dir="ltr"><<a href="mailto:suresh@drsuresh.net" target="_blank">suresh@drsuresh.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><p dir="ltr">Hi Derek,</p>
<p dir="ltr">You will need a proxy software on your server as the endpoint. (For e.g. squid)</p>
<p dir="ltr">If you are emulating a VPN, then you'd need a VPN software (OpenVPN) as the endpoint. </p>
<div class="gmail_quote"><div><div>On 23 Oct 2014 22:08, "Derek Cole" <<a href="mailto:derek.cole@gmail.com" target="_blank">derek.cole@gmail.com</a>> wrote:<br type="attribution"></div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div><div dir="ltr"><div><div><div>Hello,<br><br></div>Is it possible to use stunnel server as a transparent proxy? I was digging through the manpage and I see the <br><br>transparent=<br><br></div>option. What I would like to do is have an stunnel client connect to the stunnel server, and once traffic is at the server, go to the original destination that the traffic going to the stunnel client was destined for.<br><br>I.E. Can I have firefox proxy to my stunnel client, which connects to my stunnel server, and then that traffic goes to whatever website the end user was trying to hit in firefox?<br><br><br></div><div>My Stunnel server is on a CentOS box:<br><br>[root@CentOSTunTest ~]# uname -a<br>Linux CentOSTunTest 2.6.32-431.el6.x86_64 #1 SMP Fri Nov 22 03:15:09 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux<br><br></div><div>And my stunnel.conf <br><br><blockquote style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex" class="gmail_quote"><div style="margin-left:40px">foreground = yes<br>debug = 7<br>options = NO_SSLv2<br>fips = no<br>output=/usr/local/etc/stunnel/stunnel.log<br><br><br>[https]<br>cert=/usr/local/etc/stunnel/stunnel.pem<br>accept = 443<br>connect = 80<br><br>[Internet]<br>cert=/usr/local/etc/stunnel/stunnel.pem<br>sni = https:Internet<br>transparent=destination<br></div></blockquote><br><br></div><div>So basically in the transparent option is Internet is what I am wondering if it works the way I expect. I see this in the log file:<br><br>2014.10.23 09:57:05 LOG3[11414]: setsockopt SO_ORIGINAL_DST: Protocol not available (92)<br>2014.10.23 09:57:05 LOG5[11414]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket<br><br></div><div>I see this in the stunnel manpage:<br><br><blockquote><p>For a connect target installed on the same host:</p>
<pre> /sbin/iptables -t nat -I OUTPUT -p tcp --dport <redirected_port> \
-m ! --uid-owner <stunnel_user_id> \
-j DNAT --to-destination <local_ip>:<stunnel_port></pre>
<p>For a connect target installed on a remote host:</p>
</blockquote><blockquote> /sbin/iptables -I INPUT -i eth0 -p tcp --dport <stunnel_port> -j ACCEPT
/sbin/iptables -t nat -I PREROUTING -p tcp --dport <redirected_port> \
-i eth0 -j DNAT --to-destination <local_ip>:<stunnel_port><br></blockquote><pre><br></pre><pre>What does it mean "for a connect target installed on the same host" <br>I thought transparent meant I was not using a connect target except the original destination. Does this mean I should implement the IPTables for a remote host, since I want my client to just reach the internet?<br><br><br>Thanks for the help in advance!<br></pre><pre><br></pre><br></div><div><br><br><br></div></div>
<br></div></div>_______________________________________________<br>
stunnel-users mailing list<br>
<a href="mailto:stunnel-users@stunnel.org" target="_blank">stunnel-users@stunnel.org</a><br>
<a href="https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users" target="_blank">https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users</a><br>
<br></blockquote></div>
</blockquote></div><br></div>
</div></div></blockquote></div><br></div>
</div></div></blockquote></div><br></div>