mirror of
https://github.com/nadoo/glider.git
synced 2026-07-17 17:30:11 +08:00
123 lines
3.5 KiB
Markdown
123 lines
3.5 KiB
Markdown
|
|
## 9. Transparent Proxy without dnsmasq
|
|
|
|
PC Client -> Gateway with glider running(linux box) -> Upstream Forwarders -> Internet
|
|
|
|
#### In this mode, glider will act as the following roles:
|
|
1. A transparent proxy server
|
|
2. A dns forwarding server
|
|
3. An ipset or nftables set manager
|
|
|
|
so you don't need any dns server in your network.
|
|
|
|
#### Create a ipset manually
|
|
```bash
|
|
ipset create glider hash:net
|
|
```
|
|
|
|
#### Glider Configuration
|
|
##### glider.conf
|
|
```bash
|
|
verbose=True
|
|
|
|
# as a redir proxy
|
|
listen=redir://:1081
|
|
|
|
# as a dns forwarding server
|
|
dns=:53
|
|
dnsserver=8.8.8.8:53
|
|
dnsserver=8.8.4.4:53
|
|
|
|
# specify rule files
|
|
rules-dir=rules.d
|
|
```
|
|
|
|
##### office.rule
|
|
```bash
|
|
# add your forwarders
|
|
forward=http://forwarder1:8080,socks5://forwarder2:1080
|
|
forward=http://1.1.1.1:8080
|
|
strategy=rr
|
|
check=http://www.msftconnecttest.com/connecttest.txt#expect=200
|
|
|
|
# specify a different dns server(if need)
|
|
dnsserver=208.67.222.222:53
|
|
|
|
# as a ipset manager
|
|
ipset=glider
|
|
|
|
# specify destinations
|
|
include=office.list
|
|
|
|
domain=example1.com
|
|
domain=example2.com
|
|
# matches ip
|
|
ip=1.1.1.1
|
|
ip=2.2.2.2
|
|
# matches a ip net
|
|
cidr=192.168.100.0/24
|
|
cidr=172.16.100.0/24
|
|
```
|
|
|
|
##### office.list
|
|
```bash
|
|
# destinations list
|
|
domain=mycompany.com
|
|
domain=mycompany1.com
|
|
ip=4.4.4.4
|
|
ip=5.5.5.5
|
|
cidr=172.16.101.0/24
|
|
cidr=172.16.102.0/24
|
|
```
|
|
|
|
#### Configure iptables on your linux gateway
|
|
```bash
|
|
iptables -t nat -I PREROUTING -p tcp -m set --match-set glider dst -j REDIRECT --to-ports 1081
|
|
iptables -t nat -I OUTPUT -p tcp -m set --match-set glider dst -j REDIRECT --to-ports 1081
|
|
```
|
|
|
|
#### Nftables alternative
|
|
|
|
Use `nftset=glider` instead of `ipset=glider` in the rule file. It means
|
|
`inet/glider/glider` for IPv4 and `inet/glider/glider6` for IPv6. The table
|
|
must already exist:
|
|
|
|
```bash
|
|
nft add table inet glider
|
|
```
|
|
|
|
Glider creates both interval sets and flushes them on startup. If nftables
|
|
rules are loaded before glider starts, create compatible sets first:
|
|
|
|
```bash
|
|
nft 'add set inet glider glider { type ipv4_addr; flags interval; }'
|
|
nft 'add set inet glider glider6 { type ipv6_addr; flags interval; }'
|
|
nft 'add chain inet glider prerouting { type nat hook prerouting priority dstnat; policy accept; }'
|
|
nft 'add rule inet glider prerouting ip daddr @glider tcp redirect to :1081'
|
|
nft 'add rule inet glider prerouting ip6 daddr @glider6 tcp redirect to :1081'
|
|
```
|
|
|
|
#### Server DNS settings
|
|
Set server's nameserver to glider:
|
|
```bash
|
|
echo nameserver 127.0.0.1 > /etc/resolv.conf
|
|
```
|
|
|
|
#### Client settings
|
|
Use the linux server's ip as your gateway.
|
|
Use the linux server's ip as your dns server.
|
|
|
|
#### When client requesting to access http://example1.com (in office.rule), the whole process:
|
|
DNS Resolving:
|
|
1. client sends a udp dns request to linux server, and glider will receive the request(as it listens on the default dns port :53)
|
|
2. upstream dns server choice: glider will lookup it's rule config and find out the dns server to use for this domain(matched "example1.com" in office.rule, so 208.67.222.222:53 will be chosen)
|
|
3. glider uses the forwarder in office.rule to ask 208.67.222.222:53 for the resolve answers(dns over proxy).
|
|
4. glider updates it's office rule config, adds the resolved ip address to it.
|
|
5. glider adds the resolved ip into ipset "glider", and returns the dns answer to client.
|
|
|
|
Destination Accessing:
|
|
1. client sends http request to the resolved ip of example1.com.
|
|
2. linux gateway server will get the request.
|
|
3. iptables matches the ip in ipset "glider" and redirect this request to :1081(glider)
|
|
4. glider finds the ip in office rule, and then choose a forwarder in office.rule to complete the request.
|