[Feature] Guide to use tunsocks on linux host as a gateway to other hosts ex: LXC containers and VMs

[SkullFace141]

Description

[Feature] Guide to use tunsocks on linux host as a gateway to other hosts ex: LXC containers and VMs

the guide in the wiki shows configuration for single machine use.

Thanks

[bb33bb]

I also need this detailed documentation.

[Alecyrus]

@xjasonlyu If possible, could you please tell us how to configure gateway mode? The current wiki doesn't mention this at all.

[xjasonlyu]

Technically, there is no such gateway mode. It's just a server/host with ip forwarding enabled.

Therefore, to turn on "gateway mode", you only need to setup tun2socks as usual and enable the ip forwarding on your machine, e.g. sysctl -w net.ipv4.ip_forward=1

To let LAN clients access internet via this gateway, just configuring your clients' gateway ip to your tun2socks server's ip. easy peasy :-P

[n-r-w]

Gateway mode working fine. This is my test startup script for manual run and cleanup after finish. After run just set client gateway to server's address and all traffic going to shadowsocks-server.

#!/bin/bash
sysctl -w net.ipv4.ip_forward=1
ip tuntap add mode tun dev tun0
ip addr add 198.18.0.1/15 dev tun0
ip link set tun0 up
ip route del default via 198.18.0.1
ip route del default via 192.168.1.1
ip route add default via 198.18.0.1 dev tun0 metric 1
ip route add default via 192.168.1.1 dev ens18 metric 10
ip route add <shadowsocks-server-address>/32 via 192.168.1.1

./tun2socks -device tun0 -proxy socks5://127.0.0.1:1080 -interface ens18

sysctl -w net.ipv4.ip_forward=0
ip route del default via 198.18.0.1
ip route del default via 192.168.1.1
ip route del <shadowsocks-server-address>/32 
ip route add default via 192.168.1.1 dev ens18

[n-r-w]

But how to make it work on a router (I have ubuntu 20.04 configured as a router), I don't understand.
Here my iptables config for routing. Tried to forward from LAN to tun0, etc... Nothing helped.
LAN - enp3s0
WAN - enp4s0

*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -o enp4s0 -j MASQUERADE
COMMIT

*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
# basic global accept rules - ICMP, loopback, traceroute, established all accepted
-A INPUT -s 127.0.0.0/8 -d 127.0.0.0/8 -i lo -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -m state --state ESTABLISHED -j ACCEPT
# enable traceroute rejections to get sent out
-A INPUT -p UDP --dport 33434:33523 -j REJECT --reject-with icmp-port-unreachable
# DNS - accept from LAN
-A INPUT -i enp3s0 -p tcp --dport 53 -j ACCEPT
-A INPUT -i enp3s0 -p udp --dport 53 -j ACCEPT
-A INPUT -i enp3s0 -p tcp --dport 53 -j ACCEPT
-A INPUT -i enp3s0 -p udp --dport 53 -j ACCEPT
# SSH - accept from LAN and WAN
-A INPUT -i enp3s0 -p tcp --dport 22 -j ACCEPT
-A INPUT -i enp4s0 -p tcp --dport 22 -j ACCEPT
# DHCP client requests - accept from LAN
-A INPUT -i enp3s0 -p udp --dport 67:68 -j ACCEPT
# Refuse anything else
-A INPUT -j DROP
# Forwarding rules
# forward packets along established/related connections
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
# forward from LAN (enp3s0) to WAN (enp4s0)
-A FORWARD -i enp3s0 -o enp4s0 -j ACCEPT
# drop all other forwarded traffic
-A FORWARD -j DROP
COMMIT

[Youaresmarter]

Gateway mode working fine. This is my test startup script for manual run and cleanup after finish. After run just set client gateway to server's address and all traffic going to shadowsocks-server.

#!/bin/bash
sysctl -w net.ipv4.ip_forward=1
ip tuntap add mode tun dev tun0
ip addr add 198.18.0.1/15 dev tun0
ip link set tun0 up
ip route del default via 198.18.0.1
ip route del default via 192.168.1.1
ip route add default via 198.18.0.1 dev tun0 metric 1
ip route add default via 192.168.1.1 dev ens18 metric 10
ip route add <shadowsocks-server-address>/32 via 192.168.1.1

./tun2socks -device tun0 -proxy socks5://127.0.0.1:1080 -interface ens18

sysctl -w net.ipv4.ip_forward=0
ip route del default via 198.18.0.1
ip route del default via 192.168.1.1
ip route del <shadowsocks-server-address>/32 
ip route add default via 192.168.1.1 dev ens18

@n-r-w Hi!
The same question and still does not work. Can you explain your network structure and the script?

[n-r-w]

@Youaresmarter my full configuration https://github.com/n-r-w/tunnel

[n-r-w]

@sonvirgo I didn't fully understand your post, but the configuration I described here https://github.com/n-r-w/tunnel works right now.