Bidirectional Transparent Proxy via NetFilter Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional proxying methods are not transparent to both users and servers under full IP protocols, as they are either transparent to the user or the server but not bidirectionally, and are limited to specific application protocols, making them ineffective for all IP protocols.
Innovation Solution
A method and system for bidirectional transparent proxying using iptables rules, NetFilter mechanisms, and OSPF service to configure and manage packet routing based on protocol types, allowing the proxy to function transparently for both users and servers by using the requesting-end IP address and port as the source IP and port in the proxying process.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If conventional TCP hijacking method is used to make proxy transparent to user, then user transparency is improved, but protocol applicability deteriorates (only TCP protocol supported)
Solution Approach 1:
The patent segments the proxying function into two independent components: a user-space proxy program that handles protocol-agnostic packet interception and forwarding, and a kernel-space NetFilter module that provides protocol-specific processing capabilities. This segmentation allows the system to support multiple protocols (TCP, UDP, ICMP) while maintaining user transparency, as each protocol can be handled by its dedicated kernel module while the user-space program remains protocol-agnostic.
Solution Approach 2:
The patent introduces a user-space proxy program as an intermediary layer between the application and the kernel NetFilter module. This intermediary translates protocol-agnostic packet forwarding requests into protocol-specific operations, enabling the system to maintain both user transparency (through the unified user-space interface) and broad protocol support (through multiple kernel-space NetFilter modules).
2Ease of manufacture
If proxy server uses its own IP address for connection, then connection establishment is simplified, but server transparency deteriorates (server cannot identify original client)
Solution Approach 1:
The patent implements source address translation by copying the original client's IP address and port information from the intercepted packet and inserting it into the outbound packet sent to the server. This copying mechanism preserves the original client's identity in the server's view while the proxy server maintains the ability to establish connections using its own IP address, thus achieving both simplified connection establishment and server transparency.
Solution Approach 2:
The patent dynamically changes the source IP address parameter in the outbound packet based on the original client's information. Instead of always using the proxy server's IP address, the system modifies the source address parameter to match the original client, enabling the server to transparently identify the true client while the proxy maintains control over the connection establishment process.
3Adaptability or versatility
If socks proxy is used to support full IP protocols, then protocol applicability is improved, but user transparency deteriorates (user must install and configure client)
Solution Approach 1:
The patent replaces the mechanical configuration approach of traditional SOCKS proxies (requiring manual client installation and configuration) with an automated kernel-space NetFilter-based packet interception mechanism. This substitution eliminates the need for user-side configuration while maintaining full IP protocol support, as the kernel module automatically intercepts and processes packets for all protocols without requiring user awareness or action.
Data Source
Figure 1~2
Figure 3~4
AI summary
The present disclosure provides a method and a device for bidirectional transparent proxying. The method includes: configuring, by a first proxy end, iptables rules based on the protocol type of a requesting-end-requested packet, and receiving, by the first proxy end, the requesting-end-requested packet that is guided based on the iptables rules; sending, by the first proxy end, the requesting-end-requested packet and the protocol type of the requesting-end-requested packet to a second proxy end; based on the requesting-end-requested packet and the protocol type of the requesting-end-requested packet, sending, by the second proxy end, the requesting-end-requested packet to an acknowledging end, where a requesting-end ip address and a requesting-end port in the requesting-end-requested packet are used as a source ip address and a source port; by configuring ospf service, iptables rules and routing rules, guiding and receiving, by the second proxy end, an acknowledging-end-responded packet, and sending, by the second proxy end, the acknowledging-end-responded packet to the first proxy end; sending, by the first proxy end, the received acknowledging-end-responded packet to the requesting end. The present disclosure achieves the objective of making the proxy to be transparent to the user and server under the full ip protocol.