Firewall - how to redirect all Internet traffic to a socks proxy?

Installing and Using OpenWrt
1

Hello,

I have a ax3000t with openwrt 23.05.4. Xray-core is installed on the router, a connection to my VPS is configured and a socks proxy is specified in the settings (inbounds).
The problem is that I can't redirect Internet traffic (ports 80 and 443) to the proxy using the firewall settings.
If I specify this proxy directly on devices in the local network, then everything works as it should.
I tried the following

config redirect
        option src              lan
        option dest             wan
        option proto            tcp
        option src_dport        443
        option dest_port        10808
        option dest_ip          192.168.1.1

but it doesn't work, and in the logs I see strange lines like

2024/09/03 19:41:28 [Debug] [848111277] proxy/socks: Not Socks request, try to parse as HTTP request
2024/09/03 19:41:28 [Warning] [848111277] app/proxyman/inbound: connection ends > proxy/http: failed to read http request > invalid method "\x16\x03\x01\a\x17\x01\x00\a\x13\x03\x03\xe0k*\xc1Qj\xde\xef\xee%*\xa11\xdc\xf5\xcde\x87yV\x9e\xd4\x18\xae\xaa\xf1y\x8e\x96b\xc1\xb6"

If in the redirect section above I replace port 10808 with 22, then the redirection works and I successfully connect to the router via ssh if I specify, for example, google.com as a host in the putty.

Why does the redirection not work for the proxy, but works in other cases? How can this be explained?

2

because the firewall won't "proxyfy" the traffic for you.

try redsocks

1 Like
3

Thanks for the answer.
Does a socks proxy require special requests? I always thought it was enough to redirect traffic to it.

4

yup...

nope.

5

You dont need dest_ip to duplicate own address, default is own address if nothing is specified.
You need "transparent proxy" not "socks proxy" to direct traffic with firewall.

6

Thanks.
It looks like I'll have to use an additional package for transparent proxy, as I understand xray-core can't do that.