Firewall - how to redirect all Internet traffic to a socks proxy?

Hello,

I have a ax3000t with openwrt 23.05.4. Xray-core is installed on the router, a connection to my VPS is configured and a socks proxy is specified in the settings (inbounds).
The problem is that I can't redirect Internet traffic (ports 80 and 443) to the proxy using the firewall settings.
If I specify this proxy directly on devices in the local network, then everything works as it should.
I tried the following

config redirect
        option src              lan
        option dest             wan
        option proto            tcp
        option src_dport        443
        option dest_port        10808
        option dest_ip          192.168.1.1

but it doesn't work, and in the logs I see strange lines like

2024/09/03 19:41:28 [Debug] [848111277] proxy/socks: Not Socks request, try to parse as HTTP request
2024/09/03 19:41:28 [Warning] [848111277] app/proxyman/inbound: connection ends > proxy/http: failed to read http request > invalid method "\x16\x03\x01\a\x17\x01\x00\a\x13\x03\x03\xe0k*\xc1Qj\xde\xef\xee%*\xa11\xdc\xf5\xcde\x87yV\x9e\xd4\x18\xae\xaa\xf1y\x8e\x96b\xc1\xb6"

If in the redirect section above I replace port 10808 with 22, then the redirection works and I successfully connect to the router via ssh if I specify, for example, google.com as a host in the putty.

Why does the redirection not work for the proxy, but works in other cases? How can this be explained?

because the firewall won't "proxyfy" the traffic for you.

try redsocks

1 Like

Thanks for the answer.
Does a socks proxy require special requests? I always thought it was enough to redirect traffic to it.

yup...

nope.

You dont need dest_ip to duplicate own address, default is own address if nothing is specified.
You need "transparent proxy" not "socks proxy" to direct traffic with firewall.

Thanks.
It looks like I'll have to use an additional package for transparent proxy, as I understand xray-core can't do that.