Use Socket Ownership to Break a Local Proxy Redirect Loop

Exclude the proxy process’s own outbound sockets from a local OUTPUT redirect instead of guessing its source ports.

A local interception proxy opens new outward connections. If a blanket OUTPUT redirect captures those sockets too, it sends the proxy back to its own listener.

For an existing IPv4 iptables NAT setup, a dedicated service identity can distinguish those sockets:

-A OUTPUT -p tcp -m owner ! --uid-owner proxyuser \
  -m multiport --dports 80,443 -j REDIRECT --to-ports 8080

This ruleset fragment assumes the interception-capable listener already exists on port 8080 and the proxy’s outward sockets belong to proxyuser. That user’s connections are excluded from this rule; eligible connections from other users are redirected.

A browser normally chooses an ephemeral source port. Matching source port 80 or 443 is not a reliable way to recognize its website connections or exempt the proxy.

The owner match concerns locally generated traffic with socket ownership. It is not a substitute for a source-address policy on packets arriving from other machines.

Keep the existing rule ordering and network policy in view. The redirect does not turn a raw SOCKS listener into an interception adapter, and IPv6 needs its applicable configuration too.

Ũhoro ũhĩtĩte