redsocks for docker container

redocker.sh

cat <<EOF
TYPE The following commands:
sysctl -w net.ipv4.conf.docker0.route_localnet=1
iptables -t nat -N REDSOCKS
iptables -t nat -A REDSOCKS -d 0.0.0.0/8 -j RETURN
iptables -t nat -A REDSOCKS -d 10.0.0.0/8 -j RETURN
iptables -t nat -A REDSOCKS -d 127.0.0.0/8 -j RETURN
iptables -t nat -A REDSOCKS -d 169.254.0.0/16 -j RETURN
iptables -t nat -A REDSOCKS -d 172.16.0.0/12 -j RETURN
iptables -t nat -A REDSOCKS -d 192.168.0.0/16 -j RETURN
iptables -t nat -A REDSOCKS -d 224.0.0.0/4 -j RETURN
iptables -t nat -A REDSOCKS -d 240.0.0.0/4 -j RETURN
iptables -t nat -A REDSOCKS -p tcp -j DNAT --to-destination 127.0.0.1:12345
iptables -t nat -I PREROUTING -p tcp -i docker0 -j REDSOCKS
iptables -t nat -Z -L
sslocal -c shadowsocks.json
EOF
bash
sysctl -w net.ipv4.conf.docker0.route_localnet=0
iptables -t nat -F REDSOCKS
iptables -t nat -D PREROUTING -p tcp -i docker0 -j REDSOCKS
iptables -t nat -X REDSOCKS
iptables -t nat -vL

redir for local (instead of bridging) is trivial:

3d2
< sysctl -w net.ipv4.conf.docker0.route_localnet=1
13,14c12,13
< iptables -t nat -A REDSOCKS -p tcp -j DNAT --to-destination 127.0.0.1:12345
< iptables -t nat -I PREROUTING -p tcp -i docker0 -j REDSOCKS

---
> iptables -t nat -A REDSOCKS -p tcp -j REDIRECT --to-ports 12345
> iptables -t nat -A OUTPUT -p tcp -m owner --gid-owner $mygroupid -j REDSOCKS
19d17
< sysctl -w net.ipv4.conf.docker0.route_localnet=0
21c19
< iptables -t nat -D PREROUTING -p tcp -i docker0 -j REDSOCKS

---
> iptables -t nat -D OUTPUT -p tcp -m owner --gid-owner $mygroupid -j REDSOCKS