Skip to content

Commit 26605b0

Browse files
shadowy-pycodershadowy-pycoder
committed
updated README
1 parent 60aaaa2 commit 26605b0

File tree

1 file changed

+162
-11
lines changed

1 file changed

+162
-11
lines changed

‎README.md‎

Lines changed: 162 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,9 @@ Specify http server in proxy configuration of Postman
3434
- **Proxy Chain functionality**
3535
Supports `strict`, `dynamic`, `random`, `round_robin` chains of SOCKS5 proxy
3636

37+
- **Transparent proxy**
38+
Supports `redirect` (SO_ORIGINAL_DST) and `tproxy` (IP_TRANSPARENT) modes
39+
3740
- **DNS Leak Protection**
3841
DNS resolution occurs on SOCKS5 server side.
3942

@@ -65,7 +68,7 @@ You can download the binary for your platform from [Releases](https://github.com
6568
Example:
6669

6770
```shell
68-
HPTS_RELEASE=v1.5.0; wget -v https://github.com/shadowy-pycoder/go-http-proxy-to-socks/releases/download/$HPTS_RELEASE/gohpts-$HPTS_RELEASE-linux-amd64.tar.gz -O gohpts && tar xvzf gohpts && mv -f gohpts-$HPTS_RELEASE-linux-amd64 gohpts && ./gohpts -h
71+
HPTS_RELEASE=v1.6.0; wget -v https://github.com/shadowy-pycoder/go-http-proxy-to-socks/releases/download/$HPTS_RELEASE/gohpts-$HPTS_RELEASE-linux-amd64.tar.gz -O gohpts && tar xvzf gohpts && mv -f gohpts-$HPTS_RELEASE-linux-amd64 gohpts && ./gohpts -h
6972
```
7073

7174
Alternatively, you can install it using `go install` command (requires Go [1.24](https://go.dev/doc/install) or later):
@@ -102,23 +105,29 @@ GitHub: https://github.com/shadowy-pycoder/go-http-proxy-to-socks
102105
Usage: gohpts [OPTIONS]
103106
Options:
104107
-h Show this help message and exit.
108+
-M value
109+
Transparent proxy mode: [redirect tproxy]
110+
-T string
111+
Address of transparent proxy server (no HTTP)
105112
-U string
106-
User for HTTP proxy (basic auth). This flag invokes prompt for password (not echoed to terminal)
113+
User for HTTP proxy (basic auth). This flag invokes prompt for password (not echoed to terminal)
107114
-c string
108-
Path to certificate PEM encoded file
109-
-d Show logs in DEBUG mode
115+
Path to certificate PEM encoded file
116+
-d Show logs in DEBUG mode
110117
-f string
111-
Path to server configuration file in YAML format
112-
-j Show logs in JSON format
118+
Path to server configuration file in YAML format
119+
-j Show logs in JSON format
113120
-k string
114-
Path to private key PEM encoded file
121+
Path to private key PEM encoded file
115122
-l string
116-
Address of HTTP proxy server (default "127.0.0.1:8080")
123+
Address of HTTP proxy server (default "127.0.0.1:8080")
117124
-s string
118-
Address of SOCKS5 proxy server (default "127.0.0.1:1080")
125+
Address of SOCKS5 proxy server (default "127.0.0.1:1080")
126+
-t string
127+
Address of transparent proxy server (it starts along with HTTP proxy server)
119128
-u string
120-
User for SOCKS5 proxy authentication. This flag invokes prompt for password (not echoed to terminal)
121-
-v print version
129+
User for SOCKS5 proxy authentication. This flag invokes prompt for password (not echoed to terminal)
130+
-v print version
122131
```
123132

124133
## Example
@@ -217,6 +226,148 @@ server:
217226
218227
To learn more about proxy chains visit [Proxychains Github](https://github.com/rofl0r/proxychains-ng)
219228
229+
## Transparent proxy
230+
231+
> Also known as an `intercepting proxy`, `inline proxy`, or `forced proxy`, a transparent proxy intercepts normal application layer communication without requiring any special client configuration. Clients need not be aware of the existence of the proxy. A transparent proxy is normally located between the client and the Internet, with the proxy performing some of the functions of a gateway or router
232+
>
233+
> -- _From [Wiki](https://en.wikipedia.org/wiki/Proxy_server)_
234+
235+
This functionality available only on Linux systems and requires `iptables` setup
236+
237+
`-T` flag specifies the address for the transparent server but `GoHPTS` will be running without HTTP server.
238+
239+
`-t` flag specifies the address of transparent proxy (all other functionality stays the same).
240+
241+
In other words, `-T` spins up a single server, but `-t` two servers, http and tcp.
242+
243+
There are two modes `redirect` and `tproxy` that can be specified by `-M` flag
244+
245+
## `redirect` (Transparent proxy via NAT)
246+
247+
In this mode proxying happens with `iptables` `nat` table and `REDIRECT` target. Host of incoming packet changes to the address of running `redirect` transparent proxy, but it also contains original destination that can be retrieved with `getsockopt(SO_ORIGINAL_DST)`
248+
249+
To run `GoHPTS` in this mode you use `-t` or `-T` flags with `-M redirect`
250+
251+
### Example
252+
253+
```shell
254+
# run the proxy
255+
gohpts -s 1080 -t 1090 -M redirect -d
256+
```
257+
258+
```shell
259+
# run socks5 server on 127.0.0.1:1080
260+
ssh remote -D 1080 -Nf
261+
```
262+
263+
Setup your operating system:
264+
265+
```shell
266+
# commands below require elevated privileges (you can run it with `sudo -i`)
267+
268+
#enable ip forwarding
269+
sysctl -w net.ipv4.ip_forward=1
270+
271+
# create `GOHPTS` nat chain
272+
iptables -t nat -N GOHPTS
273+
274+
# set no redirection rules for local, http proxy, ssh and redirect procy itself
275+
iptables -t nat -A GOHPTS -d 127.0.0.0/8 -j RETURN
276+
iptables -t nat -A GOHPTS -p tcp --dport 8080 -j RETURN
277+
iptables -t nat -A GOHPTS -p tcp --dport 1090 -j RETURN
278+
iptables -t nat -A GOHPTS -p tcp --dport 22 -j RETURN
279+
280+
# redirect traffic to transparent proxy
281+
iptables -t nat -A GOHPTS -p tcp -j REDIRECT --to-ports 1090
282+
283+
# setup prerouting by adding our proxy
284+
iptables -t nat -A PREROUTING -p tcp -j GOHPTS
285+
286+
# intercept local traffic for testing
287+
iptables -t nat -A OUTPUT -p tcp -j GOHPTS
288+
```
289+
290+
Test connection:
291+
292+
```shell
293+
curl http://example.com #traffic should be redirected via 127.0.0.1:1090
294+
```
295+
296+
```shell
297+
curl --proxy http://127.0.0.1:8080 http://example.com #traffic should be redirected via 127.0.0.1:8080
298+
```
299+
300+
Undo everything:
301+
302+
```shell
303+
sysctl -w net.ipv4.ip_forward=0
304+
iptables -t nat -D PREROUTING -p tcp -j GOHPTS
305+
iptables -t nat -D OUTPUT -p tcp -j GOHPT
306+
iptables -t nat -F GOHPTS
307+
iptables -t nat -X GOHPTS
308+
```
309+
310+
## `tproxy` (Transparent proxy with IP_TRANSPARENT socket option)
311+
312+
In this mode proxying happens with `iptables` `mangle` table and `TPROXY` target. Transparent proxy sees destination address as it is, it is not being rewrited by the kernel. For this to work the proxy binds with socket option `IP_TRANSPARENT`, `iptables` intercepts traffic using TPROXY target, routing rules are used marked packets to the local proxy without changing their original destination.
313+
314+
This mode requires elevated privileges to run `GoHPTS`. You can do that by running the follwing command:
315+
316+
```shell
317+
sudo setcap 'cap_net_admin+ep' ~/go/bin/gohpts
318+
```
319+
320+
To run `GoHPTS` in this mode you use `-t` or `-T` flags with `-M tproxy`
321+
322+
### Example
323+
324+
```shell
325+
# run the proxy
326+
gohpts -s 1080 -T 0.0.0.0:1090 -M tproxy -d
327+
```
328+
329+
```shell
330+
# run socks5 server on 127.0.0.1:1080
331+
ssh remote -D 1080 -Nf
332+
```
333+
334+
Setup your operating system:
335+
336+
```shell
337+
ip netns exec ns-client ip route add default via 10.0.0.1
338+
sysctl -w net.ipv4.ip_forward=1
339+
340+
iptables -t mangle -A PREROUTING -i veth1 -p tcp -j TPROXY --on-port 1090 --tproxy-mark 0x1/0x1
341+
342+
ip rule add fwmark 1 lookup 100
343+
ip route add local 0.0.0.0/0 dev lo table 100
344+
```
345+
346+
Test connection:
347+
348+
```shell
349+
ip netns exec ns-client curl http://1.1.1.1
350+
```
351+
352+
Undo everything:
353+
354+
```shell
355+
sysctl -w net.ipv4.ip_forward=0
356+
iptables -t mangle -F
357+
ip rule del fwmark 1 lookup 100
358+
ip route flush table 100
359+
ip netns del ns-client
360+
ip link del veth1
361+
```
362+
363+
Learn more about transparent proxies by visiting the following links:
364+
365+
- [Transparent proxy support in Linux Kernel](https://docs.kernel.org/networking/tproxy.html)
366+
- [Transparent proxy tutorial by Gost](https://latest.gost.run/en/tutorials/redirect/)
367+
- [Simple tproxy example](https://github.com/FarFetchd/simple_tproxy_example)
368+
- [Golang TProxy](https://github.com/KatelynHaworth/go-tproxy)
369+
- [Transparent Proxy Implementation using eBPF and Go](https://medium.com/all-things-ebpf/building-a-transparent-proxy-with-ebpf-50a012237e76)
370+
220371
## License
221372

222373
MIT

0 commit comments

Comments
 (0)