nginx四层透明代理配置问题

Question

nginx官网说明：
The transparent parameter (1.11.0) allows outgoing connections to a proxied server originate from a non-local IP address, for example, from a real IP address of a client:

proxy_bind $remote_addr transparent;
In order for this parameter to work, it is necessary to run nginx worker processes with the superuser privileges and configure kernel routing table to intercept network traffic from the proxied server.

目前调试发现，当客户端与nginx处于同一机器上时，透明代理转发功能是正常的，但是当客户端与nginx处于不同机器，那么nginx发送的syn不被代理机器响应，问题是：怎么配置内核路由才能实现透明转发？

Answer 1

查了一会，保证路由畅通的前提下，配置如下：
iptables -t mangle -N DIVERT
iptables -t mangle -A PREROUTING -p udp -m socket -j DIVERT
iptables -t mangle -A DIVERT -j MARK --set-xmark 0x1/0xffffffff
iptables -t mangle -A DIVERT -j ACCEPT
iptables -t mangle -A PREROUTING -p tcp -s 10.0.0.0/24<被代理服务IP> --sport 8682<被代理服务端口> -j TPROXY --tproxy-mark 0x1/0x1 --on-port 0
ip rule add fwmark 1 lookup 100
ip route add local 0.0.0.0/0 dev lo table 100

service iptables save
service iptables restart

详细资料见官方：https://www.nginx.com/blog/ip-transparency-direct-server-return-nginx-plus-transparent-proxy/?utm_source=ip-transparency-direct-server-return-nginx-plus-transparent-proxy&utm_medium=blog#ip-transparency