interactsh-server behind nginx reverse proxy

[MMquant]

I'm running interactsh-server behind nginx reverse proxy. The problem is that all traffic except HTTP must be proxied using stream directive and I'm losing original real IP of the interaction. All interactions have now 127.0.0.1 remote-address.

Anybody figured out how to set up the nginx stream directive so that it proxies real IP instead of 127.0.0.1 ?

[Mzack9999]

I think that nginx should be configured with proxy_protocol enabled (ref. https://nginx.org/en/docs/stream/ngx_stream_realip_module.html) so that the original ip is streamed along with the tcp connection. At the same time we should implement it on golang side (https://www.haproxy.org/download/2.3/doc/proxy-protocol.txt). Unfortunately the best usage for network interceptors such as interactsh is to be frontmost without layers in between.

[MMquant]

As you say proxy_protocol could be supported by interactsh-server. I tried nginx-only proxy_protocol solution but without success. My nginx config for example port 25 looks as follows

    # SMTP port 25 interactions
    server {

        listen <IP>:25;
        proxy_pass 127.0.0.1:3335;
        proxy_protocol on;
    }
    server {
        listen            127.0.0.1:3335 proxy_protocol;
        proxy_pass        127.0.0.1:35;
        #proxy_protocol    on;
        #set_real_ip_from  $realip_remote_addr;
        #set_real_ip_from  $remote_addr;
        set_real_ip_from  $proxy_protocol_addr;
    }

but I'm getting an error

nginx: [emerg] host not found in set_real_ip_from "$proxy_protocol_addr" in /etc/nginx/nginx.conf:157

and nginx won't start with this configuration.

The thing is that you want to run more services on one VM. Running just one service on one VM is not so cost-effective.

[geeknik]

stream {
    resolver 8.8.8.8;  # Example DNS resolver
 
    server {
        listen 12345;
        proxy_bind $remote_addr transparent;
        proxy_pass backend.example.com:12345;
    }
}

[MMquant]

I'm getting an error when using this in stream.server block for DNS proxying

server {
        listen <IP>:53 udp;
        listen <IP>:53; #tcp
        proxy_bind $remote_addr transparent;
        proxy_pass localhost:73;
    }

2023-12-29T07:30:09.372296024Z [WRN] Could not write DNS response: 
2023-12-29T07:30:09.372300398Z ;; opcode: QUERY, status: NOERROR, id: 47883
2023-12-29T07:30:09.372310756Z ;; flags: qr aa cd; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2
2023-12-29T07:30:09.372315006Z 
2023-12-29T07:30:09.372318479Z ;; QUESTION SECTION:
2023-12-29T07:30:09.372321249Z ;KjbsiDBFggF.iSh.<redacted>.NET.    IN   A
2023-12-29T07:30:09.372324103Z 
2023-12-29T07:30:09.372326790Z ;; ANSWER SECTION:
2023-12-29T07:30:09.372329475Z KjbsiDBFggF.iSh.<redacted>.NET. 3600    IN  A   xxx.68.74.201
2023-12-29T07:30:09.372332462Z 
2023-12-29T07:30:09.372335022Z ;; AUTHORITY SECTION:
2023-12-29T07:30:09.372337653Z KjbsiDBFggF.iSh.<redacted>.NET. 3600    IN  NS  ns1.ish.<redacted>.net.
2023-12-29T07:30:09.372347717Z KjbsiDBFggF.iSh.<redacted>.NET. 3600    IN  NS  ns2.ish.<redacted>.net.
2023-12-29T07:30:09.372364618Z 
2023-12-29T07:30:09.372367440Z ;; ADDITIONAL SECTION:
2023-12-29T07:30:09.372370126Z ns1.ish.<redacted>.net. 3600    IN  A   xxx.68.74.201
2023-12-29T07:30:09.372372888Z ns2.ish.<redacted>.net. 3600    IN  A   xxx.68.74.201
2023-12-29T07:30:09.372375597Z 
2023-12-29T07:30:09.372378208Z  write udp 127.0.0.1:73->172.253.10.129:53659: sendmsg: invalid argument

Seems to be related to some low-level socket problem.

[abaykan]

Any solution to this issue? Currently facing the same one

[geeknik]

Possible solution here:

stream {
    server {
        listen 25;
        proxy_bind $remote_addr transparent;
        proxy_pass 127.0.0.1:35;
    }
}

sysctl net.ipv4.ip_forward=1

iptables -t mangle -A PREROUTING -p tcp --dport 25 -j MARK --set-mark 1

Caveats:

• IP transparency requires root privileges and system-level network configuration
• Running interactsh-server directly without a reverse proxy provides the best IP tracking capabilities

Good luck!