[tproxy] TPROXY understanding for transparent proxy to Virtual Machines

Daniel Huhardeaux tech at tootai.net
Wed Oct 21 12:14:01 CEST 2009

Hi all,

I setup a server with 2 virtual machines (kvm) using libvirt. Public 
interface is eth0, virbr1 being the VM interface with IP My 
goal is to send external traffic smtp and http to one VM in tcp 
( The other VM ( -Asterisk server- should receive 
IAX, SIP and RTP in udp. I can ping VMs from the host.

With iptables and DNAT everything is working like I want, the only 
problem is that source IP is the one from my vibr1 and not the 
origine source one. People from netfilter told me I should give a try to 
tproxy, that's what I'm trying to setup.

Context: Debian Lenny with kernel 2.6.30 and iptables 1.4.4 from 
backports. tproxy modules are loaded. Applied rules is

sudo iptables -t mangle -A PREROUTING -p tcp -d <public IP> --dport 25 
-j TPROXY --on-port 25 --on-ip --tproxy-mark 254

The mark 254 is lookup main

0:      from all lookup local
32759:  from all to lookup main
32760:  from all to lookup main
32761:  from all to lookup main
32762:  from all fwmark 0xca lookup isp2
32763:  from all fwmark 0xc9 lookup isp1
32764:  from lookup isp1
32765:  from all to lookup main
32766:  from all lookup main
32767:  from all lookup default

 From the host I can telnet port 25 of VM
$ telnet 25
Connected to
Escape character is '^]'.
220 xxx.xxx.xxx.xxx ESMTP Postfix (Debian/GNU)
telnet> quit
Connection closed.

but I can't telnet the public IP from the host or from outside :-( A 
tshark running on the VM shows no incoming traffic, problem is on the host.

The following iptables rules are the one I use for DNAT and which are 

$IPTABLES -t nat      -A PREROUTING   -p tcp  -i eth0 -d <public IP>  
--dport 25 -j DNAT --to
$IPTABLES                -A FORWARD        -p tcp  -m 
tcp                            --dport 25 -j ACCEPT

What am I missing? Can tproxy do what I want?

Thanks for any hint.



More information about the tproxy mailing list