Having recently purchased a subscription to iPredator I wanted to filter only certain traffic over the VPN and the rest, by default, over my normal ADSL account. My solution was to setup a SOCKS5 and HTTP proxy that went out over the VPN leaving the rest of the traffic to follow the default route as normal.
Please note this guide works for me on Ubuntu 9.10 (Karmic), your mileage may vary!
Step 1: Setting up the PPTP connection to iPredator
Firstly install the required packages:-
$ sudo apt-get install pptp-linux ppp
Obviously the first step is to actually get the VPN setup, so I created the peers file: /etc/ppp/peers/ipredator
pty "pptp vpn.ipredator.se --nolaunchpppd --nobuffer --loglevel 0"
name YOUR-USERNAME-HERE
remotename ipredator
file /etc/ppp/options.pptp
ipparam ipredator
nodefaultroute
persist
Next you have to populate your chap-secrets file with your password: /etc/ppp/chap-secrets:-
YOUR-USERNAME-HERE ipredator YOUR-PASSWORD-HERE *
Finally edit the /etc/ppp/options.pptp file and uncomment the require-mppe-128 line. Now if you run “pon ipredator” and tail the syslog you should find that the VPN comes up although at the moment no traffic will route over it so go ahead and and run “poff ipredator”.
Step two: Setup the SOCKS5 server
Now we need to setup the SOCKS5 server, danted. First go ahead and install it:-
$ sudo apt-get install dante-server
Next edit the config file /etc/danted.conf and make it look something like this, changing 192.168.1.0/24 to your local subnet:-
logoutput: syslog
internal: eth0 port = 1080
external: ppp0
method: none
clientmethod: none
user.privileged: proxy
user.notprivileged: proxy
user.libwrap: proxy
client pass {
from: 192.168.1.0/24 port 1-65535 to: 0.0.0.0/0
}
client pass {
from: 127.0.0.1/32 port 1-65535 to: 0.0.0.0/0
}
client block {
from: 0.0.0.0/0 to: 0.0.0.0/0
log: connect error
}
block {
from: 0.0.0.0/0 to: 127.0.0.0/8
log: connect error
}
pass {
from: 192.168.1.0/24 to: 0.0.0.0/0
protocol: tcp udp
}
pass {
from: 127.0.0.1/32 to: 0.0.0.0/0
protocol: tcp udp
}
block {
from: 0.0.0.0/0 to: 0.0.0.0/0
log: connect error
}
Finally since we will be controlling when this process starts we need to prevent it from starting at boot by running the following:-
$ sudo update-rc.d -f danted remove
$ sudo service danted stop
Step three: Setting up the HTTP Proxy
Firstly install the HTTP proxy (polipo):-
$ sudo apt-get install polipo
Now make your config file /etc/polipo/config look something like this, changing as appropriate:-
proxyAddress = "192.168.1.1" # IPv4 only
proxyPort = 3128
allowedClients = 192.168.1.0/24
allowedPorts = 1-65535
socksParentProxy = "192.168.1.1:1080"
socksProxyType = socks5
chunkHighMark = 50331648
diskCacheRoot = ""
disableIndexing = true
disableServersList = true
dnsUseGethostbyname = yes
disableVia=true
censoredHeaders = from,accept-language,x-pad,link
censorReferer = maybe
maxConnectionAge = 5m
maxConnectionRequests = 120
serverMaxSlots = 8
serverSlots = 2
tunnelAllowedPorts = 1-65535
Finally since we’ll be controlling when this service starts, prevent it from starting on boot:-
$ sudo update-rc.d -f polipo remove
$ sudo service polipo stop
Step four: Setting up the VPN routes
Now that our services are configured we need to add the magic glue that makes their requests route out via the VPN – this will be done using an ip-up.d script and an ip-down.d script.
NB: Both these scripts assume that your proxy user has user id 13, please change accordingly if this is not the case.
Create the /etc/ppp/ip.up.d/ipredator script as follows (changing 192.168.1.0/24 as appropriate):-
#!/bin/bash
# Check for the iPredator VPN.
[ "$6" == "ipredator" ] || exit 0
# Setup the extra routing table for iPredator.
ip route add table 200 via $5
ip route add 192.168.1.0/24 dev eth0 table 200
ip rule add fwmark 0x50 table 200
# Mark all packets owned by the proxy user to go through iPredator.
iptables -t mangle -A OUTPUT --match owner --uid-owner 13 -j MARK --set-mark 80
# Start the daemons we use for this VPN.
service danted start
service polipo start
Next create the /etc/ppp/ip-down.d/ipredator similarly:-
#!/bin/bash
# Check for the iPredator VPN.
[ "$6" == "ipredator" ] || exit 0
# Stop the daemons we use for this VPN.
service danted stop
service polipo stop
# Remove the packet mangling rule.
iptables -t mangle -D OUTPUT --match owner --uid-owner 13 -j MARK --set-mark 80
# Remove the extra routing table for iPredator.
ip rule del fwmark 0x50 table 200
ip route del 192.168.1.0/24 dev eth0 table 200
ip route del table 200 via $5
Ensure both scripts are executable.
Step five: Testing the services.
To test firstly bring up the VPN by running “pon ipredator”, you should see the VPN come up and both polipo and danted should be started.
Check, by default, you get your ADSL IP:-
$ wget -q -O - http://www.whatismyip.com/automation/n09230945.asp
Next check that when routing via the proxy you get a different (VPN) IP:-
$ export http_proxy=192.168.1.1:3128
$ wget -q -O - http://www.whatismyip.com/automation/n09230945.asp
If it all works congratulations, you now have a http and socks5 proxy routing traffic over your VPN while all other traffic routes out via your normal connection.
IF it fails, I’m afraid you’re stuck going through the logs etc… Sorry!
Linux
ipredator, proxy, ubuntu, vpn
