#
# iptables configuration for sending all new outgoing TCP connections via the
# SLiRP userspace PPP emulator over SSH to a random shell provider. Used to
# circumvent a block by my colocation provider on port 6667 (IRC) traffic, and
# also to prevent me accidently revealing my server's IP address when using
# various command-line tools.
#
# Install SLiRP. This assumes there is a .ssh/config entry for "ircproxy", and
# the machine it connects to has the slirp binary in its home directory.
#

# /etc/ppp/peers/slirp
10.0.2.15:10.0.2.2
linkname slirp
pty "ssh ircproxy ./slirp ppp mtu 1500"
mtu 1500
persist
noauth

# Mark all outgoing TCP connections with the firewall mark.
iptables -t mangle -A OUTPUT -p tcp -m state --state NEW \
    -j MARK --set-mark 0xCAFE

# Rewrite the source address (required otherwise default source address is
# provided by most programs / the kernel). This ensures all outgoing TCP
# connections are originated by 
iptables -t nat -A POSTROUTING -m mark --mark 0xCAFE \
    -j SNAT --to-source 10.0.2.15

# Create "ppp0" routing table and route anything with 0xCAFE firewall mark, or
# using the SLiRP special source address using it.
echo 99 ppp0 >> /etc/iproute2/rt_tables
ip rule add fwmark 0xcafe lookup ppp0
ip route add dev ppp0 table ppp0