Like many other unfortunates in large companies, I have to deal with networking policies that generally make it a right pain in the arse to do my job. Since we still have a job to do, we naturally work around the limitations (which, since everyone has to do it independently, will inevitably lead to under-the-radar security risks, you networking gits!)

Anyway...I just added another tool to my arsenal. I wrote a simple inetd service that works with Linux 2.6's iptables to find the destination IP and port, then passes control to another program (such as netcat-openbsd or connect-proxy). It will call the other program of your choice with the real destination IP and port appended to the argument list. Simple indeed, but powerful.

With appropriate iptables NAT redirects pointing to my xinetd services, I can provide myself with (apparent) proxy-free access to the Internet and into the various DCs with their screwy non-unified access methods. I don't expect the performance to be great with many connections, but being able to connect to arbitrary ports in the DCs w/o custom configuration will make life easier.

TProxyPass is at https://github.com/rmt/tproxypass

— by Robert Thomson, created 9th Jan, 2011, last modified 9th Jan, 2011 | Tags: Tech