[tor-talk] Skip nat for private traffic with anonymizing middlebox

[Cyrus <cyrus_the_great@xxxxxxxxxx>]

I run an internal network where I use two virtual machines for hosting
hidden services. I have a gateway and a web server, and the gateway is a
transparent proxy. The gateway is a Linux system using iptables based on
the directions on the Tor wiki for an anonymizing middlebox:
https://trac.torproject.org/projects/tor/wiki/doc/TransparentProxy#AnonymizingMiddlebox

These directions have one problem. Traffic from the web server can't
access the gateways services, such as SSH. I am not familiar enough with
iptables to be completely sure how to bypass these rules for requests to
the private IP of the gateway.

The rules:
# iptables -nvL -t nat
Chain PREROUTING (policy ACCEPT 5642 packets, 323K bytes)
 pkts bytes target     prot opt in     out     source
destination
 6937  483K REDIRECT   udp  --  eth1   *       0.0.0.0/0
0.0.0.0/0            udp dpt:53 redir ports 53
  827 49620 REDIRECT   tcp  --  eth1   *       0.0.0.0/0
0.0.0.0/0            tcp flags:0x17/0x02 redir ports 9040

Chain INPUT (policy ACCEPT 11502 packets, 728K bytes)
 pkts bytes target     prot opt in     out     source
destination

Chain OUTPUT (policy ACCEPT 43839 packets, 2624K bytes)
 pkts bytes target     prot opt in     out     source
destination

Chain POSTROUTING (policy ACCEPT 45541 packets, 2692K bytes)
 pkts bytes target     prot opt in     out     source
destination

Help would be appreciated so it doesn't redirect traffic going to the
gateway.
-- 
tor-talk mailing list - tor-talk@xxxxxxxxxxxxxxxxxxxx
To unsubscribe or change other settings go to
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk