redsocks 配合iptables設置全局sockts5代理

參照：http://kuaile.in/archives/1370

架構圖：

 

第一步,安裝redsocks

1. 安裝依賴

yum install libevent-devel

2. 下載編譯

git clone https://github.com/darkk/redsocks
cd redsocks
make

3. 配置

 將redsocks源碼目錄下的redsocks.conf.example復制為redsocks.conf,編輯redsocks.conf

base {
 
    // debug: connection progress & client list on SIGUSR1
    log_debug = on;
 
    // info: start and end of client session
    log_info = on;
 
    /* possible `log' values are:
     *   stderr
     *   "file:/path/to/file"
     *   syslog:FACILITY  facility is any of "daemon", "local0"..."local7"
     */
    log = stderr;
    // log = "file:/path/to/file";
    // log = "syslog:local7";
 
    // detach from console
    daemon = off;
 
    /* Change uid, gid and root directory, these options require root
     * privilegies on startup.
     * Note, your chroot may requre /etc/localtime if you write log to syslog.
     * Log is opened before chroot & uid changing.
     */
    // user = nobody;
    // group = nobody;
    // chroot = "/var/chroot";
 
    /* possible `redirector' values are:
     *   iptables   - for Linux
     *   ipf        - for FreeBSD
     *   pf         - for OpenBSD
     *   generic    - some generic redirector that MAY work
     */
    redirector = iptables;
}
 
redsocks {
    /* `local_ip' defaults to 127.0.0.1 for security reasons,
     * use 0.0.0.0 if you want to listen on every interface.
     * `local_*' are used as port to redirect to.
     */
    local_ip = 127.0.0.1;
    local_port = 12345;   //記住這個端口,這個是redsocks運行的端口
 
    // listen() queue length. Default value is SOMAXCONN and it should be
    // good enough for most of us.
    // listenq = 128; // SOMAXCONN equals 128 on my Linux box.
 
    // `max_accept_backoff` is a delay to retry `accept()` after accept
    // failure (e.g. due to lack of file descriptors). It's measured in
    // milliseconds and maximal value is 65535. `min_accept_backoff` is
    // used as initial backoff value and as a damper for `accept() after
    // close()` logic.
    // min_accept_backoff = 100;
    // max_accept_backoff = 60000;
 
    // `ip' and `port' are IP and tcp-port of proxy-server
    // You can also use hostname instead of IP, only one (random)
    // address of multihomed host will be used.
    ip = 127.0.0.1; //這個是代-理服務器的端口,如果你本地運行shadows,需要將ip設置為127.0.0.1
    port = 1080; //編輯這個端口值,修改為本地shadowsocks運行的端口
 
 
    // known types: socks4, socks5, http-connect, http-relay
    type = socks5;
 
    // login = "foobar";
    // password = "baz";
}
 
redudp {
    // `local_ip' should not be 0.0.0.0 as it's also used for outgoing
    // packets that are sent as replies - and it should be fixed
    // if we want NAT to work properly.
    local_ip = 127.0.0.1;
    local_port = 10053;
 
    // `ip' and `port' of socks5 proxy server.
    ip = 10.0.0.1;
    port = 1080;
    login = username;
    password = pazzw0rd;
 
    // redsocks knows about two options while redirecting UDP packets at
    // linux: TPROXY and REDIRECT.  TPROXY requires more complex routing
    // configuration and fresh kernel (>= 2.6.37 according to squid
    // developers[1]) but has hack-free way to get original destination
    // address, REDIRECT is easier to configure, but requires `dest_ip` and
    // `dest_port` to be set, limiting packet redirection to single
    // destination.
    // [1] http://wiki.squid-cache.org/Features/Tproxy4
    dest_ip = 8.8.8.8;
    dest_port = 53;
 
    udp_timeout = 30;
    udp_timeout_stream = 180;
}
 
dnstc {
    // fake and really dumb DNS server that returns "truncated answer" to
    // every query via UDP, RFC-compliant resolver should repeat same query
    // via TCP in this case.
    local_ip = 127.0.0.1;
    local_port = 5300;
}
 
// you can add more `redsocks' and `redudp' sections if you need.

4. 運行

./redsocks 

第二步,配置防火牆

   全局代-理是核心就是iptables規則了,這里首先假定 $SERVIER_IP為你的shadowsocks服務器的IP地址

特別注意,這里是你部署過shadowsocks服務器的地址.不是你本地shadowsocks的地址

將以下的shell命令復制粘貼到到bash中即可完成配置:

注意,請使用你的shadowsocks服務器地址替換shell命令中的$SERVER_IP)

#不重定向目的地址為服務器的包
sudo iptables -t nat -A OUTPUT -d $SERVER_IP -j RETURN  #請用你的shadowsocks服務器的地址替換$SERVER_IP
 
#不重定向私有地址的流量
sudo iptables -t nat -A OUTPUT -d 10.0.0.0/8 -j RETURN
sudo iptables -t nat -A OUTPUT -d 172.16.0.0/16 -j RETURN
sudo iptables -t nat -A OUTPUT -d 192.168.0.0/16 -j RETURN
 
#不重定向保留地址的流量,這一步很重要
sudo iptables -t nat -A OUTPUT -d 127.0.0.0/8 -j RETURN
 
#重定向所有不滿足以上條件的流量到redsocks監聽的12345端口
sudo iptables -t nat -A OUTPUT -p tcp -j REDIRECT --to-ports 12345 #12345是你的redsocks運行的端口,請根據你的情況替換它

接下來,將上面的shell保存為sh腳本,依次運行shadowsocks客戶端,redsocks客戶端和sh腳本即可.

需要額外說明的是:  如果你關閉了redsocks后,需要將之前配置的iptables規則刪除,將下面的shell命令保持為sh腳本,運行即可

#/bin/bash
sudo iptables -t nat -D OUTPUT 6
sudo iptables -t nat -D OUTPUT 5
sudo iptables -t nat -D OUTPUT 4
sudo iptables -t nat -D OUTPUT 3
sudo iptables -t nat -D OUTPUT 2
sudo iptables -t nat -D OUTPUT 1

第三步,配置ssh Tunnel

ssh -C -f -N -g -D 1236 user@Tunnel_Host -p ssh_port

 

第四步,配置pac文件到web服務器

vim sock.pac

function FindProxyForURL(url, host) { return "SOCKS 172.16.1.122:1236"; }

 

第五步,ios配置使用pac

。。。