Introduction
In this article, we will discuss how to forward traffic through VLANs and Shadowsocks via iptables on a Raspberry Pi 4. We will assume that you have already set up a separate home network using a switch and that you have configured the Raspberry Pi (RPi) to have two VLANs - VLAN11 for routed devices and VLAN22 for non-routed devices.
Setting Up VLANs on Raspberry Pi
To set up VLANs on Raspberry Pi, you need to install the package vlan and configure the interfaces. Here are the steps to follow:
- Install the
vlanpackage by running the commandsudo apt-get install vlan - Create two VLAN interfaces, one for each VLAN, using the following commands:
sudo vconfig add eth0 11
sudo vconfig add eth0 22
The above commands create VLAN11 and VLAN22 on the Ethernet interface eth0.
- Assign IP addresses to the VLAN interfaces.
sudo ifconfig vlan11 192.168.11.1 netmask 255.255.255.0 up
sudo ifconfig vlan22 192.168.22.1 netmask 255.255.255.0 up
The above commands assign IP addresses 192.168.11.1 and 192.168.22.1 to VLAN11 and VLAN22 respectively, with a netmask of 255.255.255.0.
- Configure the switch to route packets between the VLANs.
This step is outside the scope of this article as it depends on the switch manufacturer and model.
Configuring Shadowsocks on Raspberry Pi
Shadowsocks is a secure socks5 proxy designed to protect your Internet traffic. To configure Shadowsocks on Raspberry Pi, you need to install the package shadowsocks and create a configuration file.
- Install the
shadowsockspackage by running the commandsudo apt-get install shadowsocks - Create a configuration file, e.g.
/etc/shadowsocks.jsonwith the following content:
{
"server":"your_server_ip",
"server_port":8000,
"local_address":"127.0.0.1",
"local_port":1080,
"password":"your_password",
"timeout":300,
"method":"aes-256-cfb"
}
Replace the placeholders your_server_ip, your_password and the port numbers with your actual values.
- Start the Shadowsocks service by running the command
sudo systemctl start shadowsocks
The Shadowsocks service is now running and you can use it to forward traffic through it.
Forwarding Traffic through VLANs and Shadowsocks via iptables
To forward traffic through VLANs and Shadowsocks via iptables, you need to configure the NAT table. Here are the steps to follow:
- Enable IP forwarding by adding the following line to the file
/etc/sysctl.conf
net.ipv4.ip\_forward=1
This line enables IP forwarding on the Raspberry Pi.
- Add the following rules to the iptables NAT table using the command
sudo iptables -t nat -A POSTROUTING
-o vlan11 -j SNAT --to-source 192.168.11.1
-o vlan22 -j SNAT --to-source 192.168.22.1
-o tun0 -j SNAT --to-source 192.168.11.1
The above rules forward traffic from VLAN11 and VLAN22 through the Shadowsocks proxy on the interface tun0 with a source IP address of 192.168.11.1 and 192.168.22.1 respectively.
- Save the iptables rules by running the command
sudo iptables-save
The iptables rules are now configured and traffic is being forwarded through the VLANs and Shadowsocks.
In this article, we have discussed how to forward traffic through VLANs and Shadowsocks via iptables on a Raspberry Pi 4. We have covered the following key concepts:
- Setting up VLANs on Raspberry Pi
- Configuring Shadowsocks on Raspberry Pi
- Forwarding traffic through VLANs and Shadowsocks via iptables
References
-
Book: "Linux ipTables Pocket Reference" by Oskar Andreasson
-
Article: "Setting up a Raspberry Pi VLAN" by Raspberry Pi Foundation
-
Online Resource: "Shadowsocks Client Setup" by Shadowsocks