undefined | Better HN

0 pointstoast05y ago0 comments

Transparent proxying works for IPv6 as well as IPv4. It's a little challenging to do transparent proxying on a box that's not the firewall. If the firewall and the proxy are on the same ethernet broadcast domain, you can forward the packets (i think for Linux you'd need to do policy routing on the port?, for ipfw there's a forward action, i think pf would be route-to); and if they're not, you'd need to tunnel the packets to the proxy.

NAT doesn't really have much to do with it, other than you with NAT, you certainly have a device on your network that's capable of being a transparent proxy, whereas without NAT, you could just have a unmanaged switch to share your upstream connection between multiple computers; assuming your provider is enlightened and provides ethernet or an ethernet bridge with nothing else in the way.

0 comments

OJFord5y ago

> think for Linux you'd need to do policy routing on the port?

I think that's probably the crux of what I'm getting at - and I should say this is all from fiddling at home and not working in networking - with iptables you can `-j DNAT --destination $desired_dns_ip`, but if you don't have NAT then you're left with `-j REDIRECT --dport $portchange`, which yes, takes a destination port, not IP.

> other than you with NAT, you certainly have a device on your network that's capable of being a transparent proxy

Yes exactly, that's all I meant really. After all, the context is a home user configuring a home user's 'router' (i.e. switch, firewall, AP, ...) to send DNS requests to PiHole, right.

toast0OP5y ago

The first part is really just a tooling issue. iptables doesn't have a -j FORWARD to pass the packet as-is to another host, but it's certainly possible to make it happen. I didn't look at nftables to see if it does either.

OJFord5y ago

Yeah absolutely, as I said in a another branch of this thread, it's all just (plaintext even) 1s & 0s at the end of the day, you can flip some; I do understand that.

It's just that our starting point here was something like 'what can a software engineer do in an hour or so one evening to get their home DNS traffic going through a Raspberry Pi on the LAN'.

I happened to have, er, exactly this experience recently with my (OpenWRT) router(+...) and with that tooling, I couldn't make it work. I settled for DNAT for v4 & DROP^ for v6 because that's what I could get done that evening and it didn't (and hasn't) seem(ed) to be a problem.

^(as in, anything trying to use a different IP, if it's already destined for my DNS that's fine. The hope being that it falls back on v4 at least, even if not the provided DNS over v6.)

j / k navigate · click thread line to collapse

0 comments

OJFord5y ago

> think for Linux you'd need to do policy routing on the port?

> other than you with NAT, you certainly have a device on your network that's capable of being a transparent proxy

Yes exactly, that's all I meant really. After all, the context is a home user configuring a home user's 'router' (i.e. switch, firewall, AP, ...) to send DNS requests to PiHole, right.

toast0OP5y ago

OJFord5y ago

Yeah absolutely, as I said in a another branch of this thread, it's all just (plaintext even) 1s & 0s at the end of the day, you can flip some; I do understand that.

It's just that our starting point here was something like 'what can a software engineer do in an hour or so one evening to get their home DNS traffic going through a Raspberry Pi on the LAN'.

^(as in, anything trying to use a different IP, if it's already destined for my DNS that's fine. The hope being that it falls back on v4 at least, even if not the provided DNS over v6.)

j / k navigate · click thread line to collapse