Following a TPROXY Packet All the Way to the Socket
Check the receiving socket, packet mark and local policy route as one transparent-proxy delivery path.
A TPROXY counter can increase while the application receives nothing. The rule matched, but local delivery still depends on policy routing and a compatible receiving socket.
Linux TPROXY can intercept traffic without rewriting its destination as DNAT does. Packets addressed to a nonlocal destination must therefore reach an eligible local socket.
Follow the delivery path
- Traffic reaches the interception host on the intended interface and address family.
- The interception rule and packet mark identify the local-delivery policy.
- A matching policy rule selects a route that delivers the packets locally.
- The proxy uses a supported transparent listener with the required socket option.
The kernel's IPv4 example requires application support for IP_TRANSPARENT. A normal listener on the same port, or a global nonlocal-bind setting, does not establish that support.
| Observation | Next check |
|---|---|
| No relevant ingress packets | Traffic path and input interface |
| Packets arrive; interception counter stays still | Address family, chain, and match conditions |
| Rule matches; local delivery fails | Mark and policy-route selection |
| Socket listens; application sees nothing | Transparent socket capability and listener owner |
| Request begins; later replies fail | Established-socket matching and return routes |
Keep the loaded configuration and network namespace with each observation. A later rule can overwrite a mark or select another route. If interception happens on the host while the listener runs in a container, a valid host-local route does not automatically deliver into that container.
Account for later packets
The kernel example includes socket matching and a DIVERT path that marks packets belonging to transparent sockets. Omitting it can leave later traffic on a different path even when initial interception succeeds.
Use the application's supported transparent mode and the matching kernel documentation for each address family. An IPv4 local-route command does not configure IPv6, and support in one family does not establish the socket behavior of the other.
TPROXY also does not generate SOCKS negotiation. A transparent-to-SOCKS component must still discover the destination and negotiate with its upstream.
Moving from REDIRECT
Record how the existing application obtains the original destination. REDIRECT changes the destination and relies on the appropriate recovery mechanism; TPROXY needs its transparent socket and routing arrangement. Choose according to the application and source-address policy.
Pair counters with the selected route, socket capability, and application log before changing interception modes. On a distribution supplying the required facilities, a missing delivery step is a better starting point than kernel recompilation.