## iptables configuration for sending all new outgoing TCP connections via the# SLiRP userspace PPP emulator over SSH to a random shell provider. Used to# circumvent a block by my colocation provider on port 6667 (IRC) traffic, and# also to prevent me accidently revealing my server's IP address when using# various command-line tools.## Install SLiRP. This assumes there is a .ssh/config entry for "ircproxy", and# the machine it connects to has the slirp binary in its home directory.## /etc/ppp/peers/slirp10.0.2.15:10.0.2.2linkname slirppty "ssh ircproxy ./slirp ppp mtu 1500"mtu 1500persistnoauth# Mark all outgoing TCP connections with the firewall mark.iptables -t mangle -A OUTPUT -p tcp -m state --state NEW \ -j MARK --set-mark 0xCAFE# Rewrite the source address (required otherwise default source address is# provided by most programs / the kernel). This ensures all outgoing TCP# connections are originated by iptables -t nat -A POSTROUTING -m mark --mark 0xCAFE \ -j SNAT --to-source 10.0.2.15# Create "ppp0" routing table and route anything with 0xCAFE firewall mark, or# using the SLiRP special source address using it.echo 99 ppp0 >> /etc/iproute2/rt_tablesip rule add fwmark 0xcafe lookup ppp0ip route add dev ppp0 table ppp0