go-shadowsocks2

go-shadowsocks2 copied to clipboard

go-shadowsocks2 currently supports Netfilter TCP redirect, it would be terrific if it can support UDP redirect.

shadowsocks-libev already has it supported, and it only works on Linux kernels with TPROXY enabled. But TPROXY has one big shortcoming: it can only be used in PREROUTING chain of mangle table. This means that TPROXY can only redirect UDP packets sent from other machines, for example you can use TPROXY on a LAN gateway to forward all LAN UDP packets to SS server.

For iptables configuration example, please check https://github.com/shadowsocks/shadowsocks-libev#advanced-usage

Is there any way to do UDP redirect without using TPROXY?

@riobard I'm afraid not.

Set up a tun device tun0. ip link set tun0 up ip address add 192.168.1.2/24 dev tun0 ip rule add ipproto 17 table 32765 ip route add default via 192.168.1.1 table 32765

Then you can do UDP redirection without TPROXY.

@clmul

Set up a tun device tun0. ip link set tun0 up ip address add 192.168.1.2/24 dev tun0 ip rule add ipproto 17 table 32765 ip route add default via 192.168.1.1 table 32765

Then you can do UDP redirection without TPROXY.

A bit more context, please. How can the above be used with go-shadowsocks2 (this project) to accomplish proxying UDP connections whose destination (address and port) is not known in advance (essentially a user-space UDP NAT)?