Xray in TPROXY mode problem

[AGluk]

Hello everybody! Ask for your help.
Can't set Xray to operate on my router in TPROXY mode.

My inbound:

{
    "tag": "tproxy",
    "port": 12345,
    "protocol": "dokodemo-door",
    "settings": {
        "network": "tcp,udp",
        "followRedirect": true
    },
    "streamSettings": {
        "sockopt": {
            "tproxy": "tproxy"
        }
    }
}

netstat -ltun shows tcp and udp 12345 ports are oppened.

I've created the needed rule and route:

ip rule add fwmark 0x1 table 100
ip route add local 0.0.0.0/0 dev lo table 100

Then I've added the client:

iptables -t mangle -A PREROUTING -m mac --mac-source $MAC -p tcp -j TPROXY --on-port 12345 --tproxy-mark 0x1
iptables -t mangle -A PREROUTING -m mac --mac-source $MAC -p udp -j TPROXY --on-port 12345 --tproxy-mark 0x1

Аfter these commands the client lose any IPv4 access at all :(

For checking overall Xray config I've changed inbound to:

{
    "tag": "redirect",
    "port": 12345,
    "protocol": "dokodemo-door",
    "settings": {
        "network": "tcp",
        "followRedirect": true
    }
}

Then I've added the client:

iptables -t nat -A PREROUTING -m mac --mac-source $MAC -p tcp -j REDIRECT --to-port 12345

After this the client get IPv4 of my outbound VPS.
IPv6 stays untouched.

For routing IPv6 I can execute the similar command:

ip6tables -t nat -A PREROUTING -m mac --mac-source $MAC -p tcp -j REDIRECT --to-port 12345

So, Xray can connect to outbound VPS and can operate in redirect mode.
What I do wrong for transparent proxy mode?

xt_TPROXY is loaded.

Please, help...

[slinar]

When using TProxy, Xray needs to set the IP_TRANSPARENT socket option. Try running Xray as the root user. Additionally, the inbound port is set to 12345 instead of 122345 in the iptables rule.

[AGluk]

ps shows me the following:

PID    USER    VSZ    STAT    COMMAND
552    root    548m   S       /opt/sbin/xray

So yes, it runs as root.

122345 was just a typo. Of course in the config file it set to the correct value. Fixed it in my first message.

Thank you!

[slinar]

Please run the command “iptables -nvL”, I want to see the iptables rules.

[AGluk]

iptables.txt

[slinar]

I noticed that the default rule for the INPUT chain in the iptables filter table is set to DROP. When using TProxy, the INPUT chain in the filter table receives packets where the destination IP address is not the local machine's IP address. Please allow those packets to pass through.

Example:
iptables -I INPUT -m mark --mark 0x1 -j ACCEPT

[AGluk]

Unfortunately nothing changed.
I've even tried to open input at all:

iptables -P INPUT ACCEPT

I've checked the rules for marked packages:

~ # ip rule
0:	from all lookup local 
99:	from all fwmark 0x1 lookup 100 
100:	from all fwmark 0xffffaaa lookup 10 
101:	from all fwmark 0xffffaaa lookup unspec blackhole
450:	from 10.60.104.6 lookup 74 
452:	from 192.168.202.218 lookup 76 
32766:	from all lookup main 
32767:	from all lookup default 

~ # ip route show table 100
local default dev lo scope host 

[AGluk]

I've checked it for IPv6 and it works!

ip -6 rule add fwmark 0x1 table 100
ip -6 route add local ::/0 dev lo table 100

ip6tables -t mangle -A PREROUTING -m mac --mac-source $MAC -p tcp -j TPROXY --on-port 12345 --tproxy-mark 0x1
ip6tables -t mangle -A PREROUTING -m mac --mac-source $MAC -p udp -j TPROXY --on-port 12345 --tproxy-mark 0x1

[AGluk]

iptables -I INPUT -m mark --mark 0x1 -j ACCEPT

I think it can be a security problem, because anyone can mark the packages and get full access on my INPUT? Or I'm wrong?

[slinar]

Fwmark is only valid on this machine.

[AGluk]

Ok, thanks for clearing. Really sorry for stupid questions :(

[AGluk]

So, IPv6 operates fine.
I also need in the mentioned rule, but for IPv6:

ip6tables -I INPUT -m mark --mark 0x1 -j ACCEPT

WTF is wrong with IPv4???

[AGluk]

No one can help me... 😔