engineering/un-inception
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add egress shielding with Makefile and systemd services

Browse source
This commit is contained in:
Russell Ballestrini 2026-01-08 04:39:18 -05:00
parent eea492dd64
commit 22c2a1fb8a
6 changed files with 169 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

87
Makefile Normal file
View file

@ -0,0 +1,87 @@
# UN CLI Inception - Makefile
# Egress shielding setup for sandbox nodes
PREFIX ?= /usr/local
MICROSOCKS_DIR = /opt/microsocks
REDSOCKS_PORT = 12345
SOCKS_PORT = 1080
.PHONY: help egress-shield microsocks redsocks-config egress-iptables egress-services clean-egress
help:
@echo "Egress Shielding:"
@echo " make egress-shield - Full setup (build + config + iptables + services)"
@echo " make microsocks - Build microsocks SOCKS5 proxy"
@echo " make redsocks-config - Generate /etc/redsocks.conf"
@echo " make egress-iptables - Set up iptables NAT rules"
@echo " make egress-services - Install and enable systemd services"
@echo " make clean-egress - Remove egress shielding"
# Full setup
egress-shield: microsocks redsocks-config egress-services egress-iptables
@echo "Egress shielding active. All TCP exits through SOCKS proxy."
# Build microsocks
microsocks:
@echo "Building microsocks..."
apt-get install -y git build-essential
rm -rf $(MICROSOCKS_DIR)
git clone --depth 1 https://github.com/rofl0r/microsocks $(MICROSOCKS_DIR)
$(MAKE) -C $(MICROSOCKS_DIR)
ln -sf $(MICROSOCKS_DIR)/microsocks $(PREFIX)/bin/microsocks
# Generate redsocks config
redsocks-config:
@echo "Installing redsocks and config..."
apt-get install -y redsocks
cp services/redsocks.conf /etc/redsocks.conf
# Set up iptables rules
egress-iptables:
@echo "Setting up iptables NAT rules..."
# Create chain if not exists
iptables -t nat -N REDSOCKS 2>/dev/null || true
# Flush existing rules
iptables -t nat -F REDSOCKS
# Skip local traffic
iptables -t nat -A REDSOCKS -d 0.0.0.0/8 -j RETURN
iptables -t nat -A REDSOCKS -d 10.0.0.0/8 -j RETURN
iptables -t nat -A REDSOCKS -d 127.0.0.0/8 -j RETURN
iptables -t nat -A REDSOCKS -d 169.254.0.0/16 -j RETURN
iptables -t nat -A REDSOCKS -d 172.16.0.0/12 -j RETURN
iptables -t nat -A REDSOCKS -d 192.168.0.0/16 -j RETURN
iptables -t nat -A REDSOCKS -d 224.0.0.0/4 -j RETURN
iptables -t nat -A REDSOCKS -d 240.0.0.0/4 -j RETURN
# Redirect all other TCP to redsocks
iptables -t nat -A REDSOCKS -p tcp -j REDIRECT --to-ports $(REDSOCKS_PORT)
# Apply to OUTPUT chain
iptables -t nat -C OUTPUT -p tcp -j REDSOCKS 2>/dev/null || \
iptables -t nat -A OUTPUT -p tcp -j REDSOCKS
@echo "iptables rules applied."
# Install systemd services
egress-services:
@echo "Installing systemd services..."
cp services/microsocks.service /etc/systemd/system/
cp services/redsocks.service /etc/systemd/system/
cp services/egress-iptables.service /etc/systemd/system/
systemctl daemon-reload
systemctl enable --now microsocks
systemctl enable --now redsocks
systemctl enable --now egress-iptables
@echo "Services installed and running."
# Remove egress shielding
clean-egress:
@echo "Removing egress shielding..."
-systemctl disable --now microsocks redsocks egress-iptables 2>/dev/null
-rm -f /etc/systemd/system/microsocks.service
-rm -f /etc/systemd/system/redsocks.service
-rm -f /etc/systemd/system/egress-iptables.service
-systemctl daemon-reload
-iptables -t nat -D OUTPUT -p tcp -j REDSOCKS 2>/dev/null
-iptables -t nat -F REDSOCKS 2>/dev/null
-iptables -t nat -X REDSOCKS 2>/dev/null
-rm -rf $(MICROSOCKS_DIR)
-rm -f $(PREFIX)/bin/microsocks
@echo "Egress shielding removed."

26
README.md
View file

@ -256,28 +256,16 @@ Sandbox nodes route HTTP/HTTPS through tinyproxy, but raw TCP (SSH, etc.) goes o
redsocks intercepts ALL outbound TCP and routes through the SOCKS proxy. No per-app configuration needed.
```bash
# Install
apt install redsocks
git clone https://github.com/rofl0r/microsocks && cd microsocks && make
# Quick setup
make egress-shield
# Run microsocks (SOCKS5 proxy)
./microsocks -p 1080
# Configure redsocks to use it
cat > /etc/redsocks.conf <<EOF
base { log_debug = off; log_info = off; daemon = on; }
redsocks { local_ip = 127.0.0.1; local_port = 12345; ip = 127.0.0.1; port = 1080; type = socks5; }
EOF
# iptables: redirect all outbound TCP (except to proxy itself)
iptables -t nat -N REDSOCKS
iptables -t nat -A REDSOCKS -d 127.0.0.0/8 -j RETURN
iptables -t nat -A REDSOCKS -p tcp -j REDIRECT --to-ports 12345
iptables -t nat -A OUTPUT -p tcp -j REDSOCKS
# Or step by step
make microsocks # Build SOCKS5 proxy
make redsocks-config # Generate /etc/redsocks.conf
make egress-iptables # Set up iptables rules
make egress-services # Install and start systemd services
```
Everything exits through one IP. Done.
**What's shielded:**
- All egress IPs - HTTP, SSH, everything

29
services/egress-iptables.service Normal file
View file

@ -0,0 +1,29 @@
[Unit]
Description=Egress shielding iptables rules
After=network.target redsocks.service
Requires=redsocks.service
[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/bin/bash -c '\
iptables -t nat -N REDSOCKS 2>/dev/null || true; \
iptables -t nat -F REDSOCKS; \
iptables -t nat -A REDSOCKS -d 0.0.0.0/8 -j RETURN; \
iptables -t nat -A REDSOCKS -d 10.0.0.0/8 -j RETURN; \
iptables -t nat -A REDSOCKS -d 127.0.0.0/8 -j RETURN; \
iptables -t nat -A REDSOCKS -d 169.254.0.0/16 -j RETURN; \
iptables -t nat -A REDSOCKS -d 172.16.0.0/12 -j RETURN; \
iptables -t nat -A REDSOCKS -d 192.168.0.0/16 -j RETURN; \
iptables -t nat -A REDSOCKS -d 224.0.0.0/4 -j RETURN; \
iptables -t nat -A REDSOCKS -d 240.0.0.0/4 -j RETURN; \
iptables -t nat -A REDSOCKS -p tcp -j REDIRECT --to-ports 12345; \
iptables -t nat -C OUTPUT -p tcp -j REDSOCKS 2>/dev/null || \
iptables -t nat -A OUTPUT -p tcp -j REDSOCKS'
ExecStop=/bin/bash -c '\
iptables -t nat -D OUTPUT -p tcp -j REDSOCKS 2>/dev/null || true; \
iptables -t nat -F REDSOCKS 2>/dev/null || true; \
iptables -t nat -X REDSOCKS 2>/dev/null || true'
[Install]
WantedBy=multi-user.target

12
services/microsocks.service Normal file
View file

@ -0,0 +1,12 @@
[Unit]
Description=microsocks SOCKS5 proxy for egress shielding
After=network.target
[Service]
Type=simple
ExecStart=/usr/local/bin/microsocks -i 127.0.0.1 -p 1080
Restart=always
RestartSec=5
[Install]
WantedBy=multi-user.target

20
services/redsocks.conf Normal file
View file

@ -0,0 +1,20 @@
// Egress shielding redsocks configuration
// Redirects all TCP through local SOCKS5 proxy
base {
log_debug = off;
log_info = on;
daemon = on;
redirector = iptables;
}
redsocks {
// Listen for redirected connections
local_ip = 127.0.0.1;
local_port = 12345;
// Forward to microsocks
ip = 127.0.0.1;
port = 1080;
type = socks5;
}

14
services/redsocks.service Normal file
View file

@ -0,0 +1,14 @@
[Unit]
Description=redsocks transparent TCP redirector
After=network.target microsocks.service
Requires=microsocks.service
[Service]
Type=forking
ExecStart=/usr/sbin/redsocks -c /etc/redsocks.conf
ExecReload=/bin/kill -HUP $MAINPID
Restart=always
RestartSec=5
[Install]
WantedBy=multi-user.target