Use Socket Ownership to Break a Local Proxy Redirect Loop
Exclude the proxy process’s own outbound sockets from a local OUTPUT redirect instead of guessing its source ports.
A local interception proxy opens new outward connections. If a blanket OUTPUT redirect captures those sockets too, it sends the proxy back to its own listener.
For an existing IPv4 iptables NAT setup, a dedicated service identity can distinguish those sockets:
-A OUTPUT -p tcp -m owner ! --uid-owner proxyuser \
-m multiport --dports 80,443 -j REDIRECT --to-ports 8080This ruleset fragment assumes the interception-capable listener already exists on port 8080 and the proxy’s outward sockets belong to proxyuser. That user’s connections are excluded from this rule; eligible connections from other users are redirected.
A browser normally chooses an ephemeral source port. Matching source port 80 or 443 is not a reliable way to recognize its website connections or exempt the proxy.
The owner match concerns locally generated traffic with socket ownership. It is not a substitute for a source-address policy on packets arriving from other machines.
Keep the existing rule ordering and network policy in view. The redirect does not turn a raw SOCKS listener into an interception adapter, and IPv6 needs its applicable configuration too.