Re: Privoxy on router firmwares poses a huge security risk
richard lucassen <[email protected]>
| Newsgroups | gmane.comp.web.privoxy.user |
|---|---|
| Organization | XAQ Systems |
| Message-ID | <[email protected]> |
On Wed, 1 Jan 2020 17:59:55 -0500 Lee <[email protected]> wrote: > > Disclaimer: not tested, just my 2 cts. > > & my own disclaimer - I've never used iptables > > If you can have rules for after the routing decision has been made and > you can tell if the traffic came from privoxy, it seems like you could > do something simpler like > > -- allow traffic from privoxy back 'inside' > if destination interface == eth0 (connection to the internal network) > AND -m owner --uid-owner privoxy then allow > > -- policy based routing: privoxy -> internet traffic is redirected > out the vpn interface > output interface == wan0 (connection to the isp) AND -m owner > --uid-owner privoxy then redirect to tun1 (vpn connection) Wouldn't it be simpler to bind privoxy to its own ip address, e.g. 192.168.1.2, and use pbr? ip rule add from 192.168.1.2 lookup 10 ip route add 192.168.2.0/24 dev eth1 table 10 # internal network ip route add 192.168.1.0/24 dev eth0 table 10 # external network ip route add default via 192.168.1.254 dev eth0 Disclaimer: not tested ;-) -- richard lucassen http://contact.xaq.nl/