LAN routing through transparent socks proxy

It took traffic from all home devices, including smartphones, via ssh tunnel.

I advise another method using tun2socks.

There was:

• TP-LINK router connected to the provider.
• Smartphones and laptop connected to a wireless access point of the router.

The laptop was far from the router (in another room) and was used regularly, so I had to look for a solution to traffic routing using the built-in wireless interface (and without eth0 there).

Toolkit:

openssh-client - standard ssh client for linux.
autossh - allows you to check the connection with the ssh server, and connect when broken.
redsocks is a transparent socks proxy server.
isc-dhcp-server - dhcp server.
iptables - I think the comments are unnecessary.

So let's get started. First of all, let's raise the DHCP server on the laptop’s wireless interface.

Installation:

apt install isc-dhcp-server

Set up the desired interface:

nano /etc/network/interfaces

# Назначаем статический IP адрес для DHCP сервера на wlan0:
auto wlan0
iface wlan0 inet static
    address 192.168.1.100
    netmask 255.255.255.0
    broadcast 192.168.1.255
    gateway 192.168.1.1

You can find out the name of the required interface with the command:

ip a

Assign DNS:

nano /etc/resolv.conf

# Публичные DNS сереверы Google:
nameserver 8.8.8.8
nameserver 8.8.4.4
# (или DNS серверы провайдера)

Next, configure the dhcp server itself:

nano /etc/default/isc-dhcp-server

It should contain a line indicating the required interface:

INTERFACESv4="wlan0"

Daemon setup:

nano /etc/dhcp/dhcpd.conf

option domain-name "mydebian";
# Публичные DNS сереверы Google (или DNS серверы провайдера):
option domain-name-servers 8.8.8.8, 8.8.4.4;
# Настройки подсети:
subnet 192.168.1.0 netmask 255.255.255.0 {
    range 192.168.1.101 192.168.1.254;
    option subnet-mask 255.255.255.0;
    option broadcast-address 192.168.1.255;
    option routers 192.168.1.100;
    option domain-name-servers home;
}
default-lease-time 600;
max-lease-time 7200;

Let's go over the main parameters:

option domain-name-servers - the addresses of the DNS servers that clients will receive when they connect. If there is a local DNS server (like mine), you must specify the interface address 192.168.1.100.

range - the range of assigned IP addresses.

option routers - this address will serve as a gateway for clients.

Configuration is complete, you must restart the service with the command:

service isc-dhcp-server restart

You can check the status with the command:

service isc-dhcp-server status

It remains only to configure the router to use our DHCP server, namely, switch the DHCP mode in the LAN settings to “Relay” and indicate there, the IP address of our DHCP server is 192.168.1.100.

Now all devices connecting to the access point of the router will receive network settings from the laptop’s network interface, but the Internet access itself needs to be configured. Let me remind you that the task is for the traffic of all devices, including the laptop, to be wrapped in an ssh tunnel. In my opinion, it is more reasonable to run an ssh tunnel as a service that will accept redirects from the redsocks proxy server.

Install the necessary tools:

apt install openssh-client autossh 

If we want to have a permanent ssh tunnel that activates when the system boots, we need to create a systemd service and enable it. Since we will use autossh, it should be noted that the -f parameter (work in the background) including the AUTOSSH_GATETIME = 0 parameter is not supported in systemd. Therefore, you must specify the use of the AUTOSSH_GATETIME = 0 parameter explicitly. Here is the basic configuration of the service:

nano /etc/systemd/system/ssh-tunnel.service

[Unit]
Description=AutoSSH tunnel on dynamic port 1080
After=network.target
[Service]
Environment="AUTOSSH_GATETIME=0"
ExecStart=/usr/bin/autossh -M 0 -o "ServerAliveInterval 30" -o  "ServerAliveCountMax 3" -ND 1080 user@server -p 22
[Install]
WantedBy=multi-user.target

Let's analyze the contents:

After = network.target - Start the service if there is a network connection.
Environment = "AUTOSSH_GATETIME = 0" - indicates systemd ssh operation in the background.

Separately, consider the parameter ExecStart:

 /usr/bin/autossh -M 0 -o "ServerAliveInterval 30" -o  "ServerAliveCountMax 3" -ND 1080 user@server -p 22 -

Start autossh with the following parameters:

-M - monitoring port. With this parameter, autossh will continuously send requests to the server through the specified ports, if no response comes from the server, autossh reconnects. The specified monitoring port and the port order above (+1) must be free in the system. Since this makes such monitoring not practical, we disable this function by specifying a value of 0.

"- o ServerAliveInterval" and "-o ServerAliveCountMax" are two options that tell the ssh client to send requests to the server directly through the tunnel (what we need) to support connection when it is not active. Also, if there is no response from the server, the connection will be considered disconnected and autossh will reconnect.

-N- do not send commands to the server.
-D 1080 - open the dynamic port on localhost.
user @ server - here you should specify the user and address (domain name) of the server.
-p 22 - specify the connection port.

Reboot the daemon:

systemctl daemon-reload

We start the service:

systemctl start ssh-tunnel

Turn on startup at boot time:

systemctl enable ssh-tunnel

So, the DCHP server on the laptop’s wireless interface and a stable ssh tunnel in the system were launched, it remains only to wrap traffic from all devices on the local network in it. We will do this with redsocks and iptables.

Installation:

apt install redsocks

Setup:

nano /etc/redsocks.conf

Editing the section:

redsocks {
        /* Адрес и порт для входящих соединений */
        local_ip = 0.0.0.0;
        local_port = 12345;
        // Адрес и порт ssh туннеля.
        ip = 127.0.0.1;
        port = 1080;
}

Save the config and restart the service:

service redsocks restart

Remained, the last trick with using iptables. I suggest immediately creating a script with the following contents:

#!/bin/bash
iptables -t nat -N REDSOCKS # Создается новая цепочка
iptables -t nat -A REDSOCKS -d 192.168.1.1 -j RETURN # Указанные адреса и под-сети, например 192.168.0.0/24, не будут перенаправляться .
iptables -t nat -A REDSOCKS -p tcp -j REDIRECT --to-ports 12345 # Перенаправлять все исходящие подключения хоста.
iptables -t nat -A OUTPUT -p tcp -m owner --uid-owner user -j REDSOCKS # Перенаправлять исходящие подключения пользователя "user".
iptables -t nat -A PREROUTING --in-interface wlan0 -p tcp -j REDSOCKS # Перенаправлять все входящие соединения с интерфейса wlan0.

Now all requests from the local network, including the host, will be routed to the ssh tunnel.