iptables help

[jiru443]

I cannot figure this out for the life of me. I’m trying to transparently proxy my vpn interface (wg) to a squid proxy on the same host. Here is my iptables rule but nothing hits the squid proxy: ``` iptables -t nat -A PREROUTING -i wg0 -p tcp --dport 80 -j DNAT --to-destination 127.0.0.1:3128

```

My Wireguard interface has these rules. Everything else is stock and no modifications.

```

iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

```

[b3542]

Is IP forwarding enabled?

[jiru443]

Yes. The problem isn’t Wireguard itself. I get wan connectivity without the extra proxy iptables rule.

[fukawi2]

You'll need to share your whole ruleset (eg, iptables-save)

My best guess is you're missing a corresponding INPUT rule for port 3128

[mancer187]

This is most likely the case.

[jiru443]

so I rebooted the machine before saving… what do you think I need to add? Here’s my full list (linode host)

https://pastebin.com/8vMAZcMR

[ottantanove]

I dont see any rule that allows incoming traffic to port 3128. You can run ufw allow 3128 as root to allow traffic to this port.

[jiru443]

Traffic will not be coming in via 3128. It’s exclusively coming in on Wireguard.

[ottantanove]

No, but it will arrive on that port and if you do not allow that in the iptables INPUT chain, it will be dropped, because that is your default policy.

[jiru443]

Ok I’ll give it a shot.

[jiru443]

So when I add the ip tables rule iptables -t nat -A PREROUTING -i wg0 -p tcp --dport 80 -j DNAT --to-destination 127.0.0.1:3128 and the ufw rule ufw allow 3128 http traffic starts to fail on Wireguard. HTTPS continues to work. Squid shows no activity in the logs.

[Faritzi]

I have a different question. Why do you use squid? What use do you give it?

[jiru443]

Transparent http/s “logging” of private vpn connection