My redsocks proxy connection has stopped working - new security somewhere?

[chrisisbd]

I have a pretty trivial little script to use my laptop as a WiFi hotspot proxied to a UK site for use when I'm in Europe so I can pretend I'm in UK still for silly web sites and such that require this.

The script is:-

#!/bin/bash
#
#
# Set up T470 to be a WiFi Hotspot and set up a proxy connection so
# that WiFi client devices will seem to be in the UK
#
# The t470 must have a wired connection to the internet (can be via the
# router on Odin which uses WiFi on the WAN side)
#
#
#
# Disconnect any existing WiFi
#
nmcli device disconnect wlp4s0
#
#
# Activate the WiFi hotspot
#
nmcli radio wifi on
nmcli connection up 'WiFi Hotspot'
#
#
# Set up Socks proxy to Halon (can be another host of course). Firefox
# can use this proxy directly as well.
#
ssh -fTnN -D 1080 [email protected]
#
#
# Now do iptables configuration so WiFi connections get to redsocks
#
echo "sudo password request is for t470"
sudo iptables -F
sudo iptables -t nat -F
sudo iptables -t nat -A PREROUTING -s 10.42.0.0/24 -p tcp -j REDIRECT --to-ports 12345

This has now stopped working (probably in the last year or so, I don't use it very often), clients connect momentarily and then disconnect. In addition Firefox fails to use the ssh proxy connection with a security error.

I run redsocks with "/usr/sbin/redsocks -c /etc/redsocks.conf", the configuration file is:-

base {
        // debug: connection progress & client list on SIGUSR1
        log_debug = off;

        // info: start and end of client session
        log_info = on;

        /* possible `log' values are:
         *   stderr
         *   "file:/path/to/file"
         *   syslog:FACILITY  facility is any of "daemon", "local0"..."local7"
         */
        log = "syslog:daemon";

        // detach from console
        daemon = on;

        /* Change uid, gid and root directory, these options require root
         * privilegies on startup.
         * Note, your chroot may requre /etc/localtime if you write log to syslog.
         * Log is opened before chroot & uid changing.
         */
        user = redsocks;
        group = redsocks;
        // chroot = "/var/chroot";

        /* possible `redirector' values are:
         *   iptables   - for Linux
         *   ipf        - for FreeBSD
         *   pf         - for OpenBSD
         *   generic    - some generic redirector that MAY work
         */
        redirector = iptables;
}

redsocks {
        /* `local_ip' defaults to 127.0.0.1 for security reasons,
         * use 0.0.0.0 if you want to listen on every interface.
         * `local_*' are used as port to redirect to.
         */
        local_ip = 0.0.0.0;
        local_port = 12345;

        // `ip' and `port' are IP and tcp-port of proxy-server
        // You can also use hostname instead of IP, only one (random)
        // address of multihomed host will be used.
        ip = 127.0.0.1;
        port = 8080;


        // known types: socks4, socks5, http-connect, http-relay
        type = socks5;

        // login = "foobar";
        // password = "baz";
}

redudp {
        // `local_ip' should not be 0.0.0.0 as it's also used for outgoing
        // packets that are sent as replies - and it should be fixed
        // if we want NAT to work properly.
        local_ip = 127.0.0.1;
        local_port = 10053;

        // `ip' and `port' of socks5 proxy server.
        ip = 192.0.2.1;
        port = 1080;
        login = username;
        password = pazzw0rd;

        // kernel does not give us this information, so we have to duplicate it
        // in both iptables rules and configuration file.  By the way, you can
        // set `local_ip' to 127.45.67.89 if you need more than 65535 ports to
        // forward ;-)
        // This limitation may be relaxed in future versions using contrack-tools.
        dest_ip = 192.0.2.2;
        dest_port = 53;

        udp_timeout = 30;
        udp_timeout_stream = 180;
}

dnstc {
        // fake and really dumb DNS server that returns "truncated answer" to
        // every query via UDP, RFC-compliant resolver should repeat same query
        // via TCP in this case.
        local_ip = 127.0.0.1;
        local_port = 5300;
}

// you can add more `redsocks' and `redudp' sections if you need.

Does anyone have any suggestions as to what might be wrong?