Skip to content

Commit 6b8d8ae

Browse files
techroy23techroy23
committed
refactor: hardcode ports, remove WARP_MODE, add socat expose, simplify logs
- Remove WARP_PORT/REDSOCKS_PORT env vars, hardcode 40000/50000 - Remove WARP_MODE env var, always use proxy mode - Add func_expose_warp: socat binds 0.0.0.0:40001 -> 127.0.0.1:40000 - Rephrase all log messages to be beginner-friendly - Install socat in both Dockerfiles - Normalize tabs to spaces
1 parent 5f29c5f commit 6b8d8ae

4 files changed

Lines changed: 84 additions & 88 deletions

File tree

‎Dockerfile.alpine‎

Lines changed: 14 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,23 @@
11
FROM alpine:latest
22

3-
ENV WARP_MODE=proxy
43

54
RUN apk update && apk add --no-cache \
65
curl \
7-
gnupg \
8-
lsb-release \
9-
ca-certificates \
6+
gnupg \
7+
lsb-release \
8+
ca-certificates \
109
iproute2 \
11-
dbus \
12-
procps \
13-
net-tools \
14-
iptables \
10+
dbus \
11+
procps \
12+
net-tools \
13+
iptables \
1514
redsocks \
16-
dos2unix \
17-
binutils \
15+
dos2unix \
16+
coreutils \
17+
socat \
18+
&& rm -rf /var/cache/apk/*
19+
20+
RUN apk add --no-cache binutils \
1821
&& WARP_DEB_URL=$( \
1922
curl -fsSL "https://pkg.cloudflareclient.com/dists/noble/main/binary-amd64/Packages.gz" \
2023
| gunzip | grep -m1 '^Filename: ' | awk '{print $2}' \
@@ -23,8 +26,7 @@ RUN apk update && apk add --no-cache \
2326
&& mkdir -p /tmp/warp-extract && cd /tmp/warp-extract \
2427
&& ar x /tmp/warp.deb && tar xf data.tar.* -C / \
2528
&& rm -rf /tmp/warp* \
26-
&& apk del binutils \
27-
&& rm -rf /var/cache/apk/*
29+
&& apk del binutils
2830

2931
WORKDIR /app
3032
COPY *.sh /app/

‎Dockerfile.ubuntu‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
FROM ubuntu:24.04
22

3-
ENV WARP_MODE=proxy
43

54
RUN apt-get update && apt-get install -y \
65
curl \
@@ -14,6 +13,8 @@ RUN apt-get update && apt-get install -y \
1413
iptables \
1514
redsocks \
1615
dos2unix \
16+
coreutils \
17+
socat \
1718
&& rm -rf /var/lib/apt/lists/*
1819

1920
RUN curl -fsSL https://pkg.cloudflareclient.com/pubkey.gpg | gpg --yes --dearmor --output /usr/share/keyrings/cloudflare-warp-archive-keyring.gpg \

‎README.md‎

Lines changed: 11 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1,30 +1,29 @@
11
# Docker-Warp-Redsocks
22

3-
Docker base image that runs any application behind a transparent proxy stack — Cloudflare WARP + Redsocks + iptables.
3+
Docker base image that routes all outbound traffic through Cloudflare WARP via a transparent proxy stack.
44

55
## Variants
66

7-
| Image | Base | Size |
8-
|-------|------|------|
9-
| `ghcr.io/techroy23/docker-warp-redsocks:alpine` | Alpine Linux | Lightweight |
10-
| `ghcr.io/techroy23/docker-warp-redsocks:ubuntu` | Ubuntu 24.04 | Heavier, official WARP deb |
7+
| Image | Base |
8+
|-------|------|
9+
| `ghcr.io/techroy23/docker-warp-redsocks:alpine` | Alpine Linux |
10+
| `ghcr.io/techroy23/docker-warp-redsocks:ubuntu` | Ubuntu 24.04 |
1111

1212
## How it works
1313

14-
1. WARP client starts, exposes a SOCKS5 proxy on port `40000`
15-
2. Redsocks listens on port `50000`, forwarding all TCP to WARP's SOCKS5
16-
3. iptables `OUTPUT` chain redirects all outbound TCP traffic (except localhost, DNS, proxy ports) to Redsocks
17-
4. A monitor loop checks connectivity every 3 minutes, restarts the stack on 3 consecutive failures
18-
5. Ready signal: `/tmp/redsocks.ready` is created once the proxy is verified working
14+
1. Cloudflare WARP starts and binds a SOCKS5 proxy to `127.0.0.1:40000`
15+
2. Socat opens `0.0.0.0:40001` so external hosts can also use WARP as a SOCKS5 proxy
16+
3. Redsocks listens on `127.0.0.1:50000` and forwards all traffic to WARP's SOCKS5
17+
4. iptables `OUTPUT` chain redirects all outbound TCP (except localhost, DNS, and proxy ports) to Redsocks
18+
5. A monitor loop checks connectivity every 3 minutes and restarts the stack after 3 consecutive failures
19+
6. Ready signal: `/tmp/redsocks.ready` is created once everything is verified working
1920

2021
## Usage
2122

2223
### 1. Import in your Dockerfile
2324

2425
```dockerfile
2526
FROM ghcr.io/techroy23/docker-warp-redsocks:alpine
26-
# or
27-
# FROM ghcr.io/techroy23/docker-warp-redsocks:ubuntu
2827

2928
COPY . /app
3029
```
@@ -58,20 +57,10 @@ exec ./your_program
5857

5958
| Variable | Default | Description |
6059
|----------|---------|-------------|
61-
| `WARP_PORT` | `40000` | WARP SOCKS5 proxy port |
62-
| `REDSOCKS_PORT` | `50000` | Redsocks transparent proxy port |
63-
| `WARP_MODE` | `proxy` | WARP mode: `proxy`, `warp`, or `gateway` |
6460
| `SHOW_LOGS` | `false` | Show Redsocks logs on stderr |
6561

6662
```bash
67-
# Warp mode
68-
docker run -e WARP_MODE=warp yourimage
69-
70-
# Show debug logs
7163
docker run -e SHOW_LOGS=true yourimage
72-
73-
# Custom ports
74-
docker run -e WARP_PORT=40001 -e REDSOCKS_PORT=50001 yourimage
7564
```
7665

7766
## Requirements

‎__setup_proxy.sh‎

Lines changed: 57 additions & 53 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,6 @@
11
#!/bin/bash
22
set -e
33

4-
WARP_PORT="${WARP_PORT:-40000}"
5-
REDSOCKS_PORT="${REDSOCKS_PORT:-50000}"
6-
WARP_MODE="${WARP_MODE:-proxy}"
74
SHOW_LOGS="$(echo "${SHOW_LOGS:-false}" | tr '[:upper:]' '[:lower:]')"
85

96
log() {
@@ -12,68 +9,67 @@ log() {
129

1310
func_net_admin() {
1411
if ! iptables -L >/dev/null 2>&1; then
15-
log "[ERROR] iptables not usable. Missing NET_ADMIN/NET_RAW or root privileges."
16-
log "[INFO] Run container with: --cap-add=NET_ADMIN --cap-add=NET_RAW --sysctl net.ipv4.ip_forward=1"
12+
log "[ERROR] Cannot use iptables — missing required permissions."
13+
log "[INFO] Fix: add --cap-add=NET_ADMIN --cap-add=NET_RAW --sysctl net.ipv4.ip_forward=1 to your docker run command"
1714
exit 1
1815
fi
1916
}
2017

2118
func_start_warp() {
22-
log "[INFO] Starting Cloudflare WARP in ${WARP_MODE} mode..."
19+
log "[INFO] Starting Cloudflare WARP in proxy mode..."
2320

24-
log "[CMD] rm -rf /var/lib/cloudflare-warp/* 2>/dev/null || true"
21+
log "[STOP] Clearing old WARP data..."
2522
rm -rf /var/lib/cloudflare-warp/* 2>/dev/null || true
2623
sleep 2
2724

25+
log "[START] Starting message bus (dbus)..."
2826
mkdir -p /run/dbus
29-
log "[CMD] dbus-daemon --system --fork >/dev/null 2>&1 &"
3027
dbus-daemon --system --fork >/dev/null 2>&1 &
3128
sleep 2
3229

33-
log "[CMD] warp-svc >/dev/null 2>&1 &"
30+
log "[START] Starting WARP service..."
3431
warp-svc >/dev/null 2>&1 &
3532
sleep 2
3633

37-
log "[CMD] warp-cli --accept-tos registration new"
38-
warp-cli --accept-tos registration new
34+
log "[WARP] Registering your device with Cloudflare..."
35+
warp-cli --accept-tos registration new || true
3936
sleep 2
4037

41-
log "[CMD] echo y | warp-cli --accept-tos connect"
42-
echo y | warp-cli --accept-tos connect
43-
sleep 2
44-
45-
log "[CMD] warp-cli --accept-tos connect"
46-
warp-cli --accept-tos connect
47-
sleep 2
48-
49-
log "[CMD] warp-cli --accept-tos mode ${WARP_MODE}"
50-
warp-cli --accept-tos mode ${WARP_MODE}
51-
sleep 2
52-
53-
log "[CMD] warp-cli --accept-tos proxy port ${WARP_PORT}"
54-
warp-cli --accept-tos proxy port "${WARP_PORT}"
38+
log "[WARP] Connecting (first attempt)..."
39+
echo y | warp-cli --accept-tos connect || true
5540
sleep 2
5641

57-
log "[CMD] warp-cli --accept-tos status"
58-
warp-cli --accept-tos status
59-
sleep 5
60-
61-
log "[CMD] netstat -lntup | grep 40000"
62-
netstat -lntup | grep 40000
63-
log "[CMD] curl -s --socks5 127.0.0.1:40000 https://www.cloudflare.com/cdn-cgi/trace | grep warp"
64-
curl -s --socks5 127.0.0.1:40000 https://www.cloudflare.com/cdn-cgi/trace | grep warp
42+
log "[WARP] Connecting (second attempt)..."
43+
warp-cli --accept-tos connect || true
44+
sleep 2
45+
46+
log "[WARP] Setting mode to proxy..."
47+
warp-cli --accept-tos mode proxy || true
48+
sleep 2
49+
50+
log "[WARP] Setting proxy port to 40000..."
51+
warp-cli --accept-tos proxy port "40000" || true
52+
sleep 2
53+
54+
log "[WARP] Checking connection status..."
55+
warp-cli --accept-tos status || true
56+
sleep 5
57+
58+
log "[CHECK] Verifying WARP is listening on port 40000..."
59+
netstat -lntup | grep 40000
60+
log "[CHECK] Testing WARP proxy through Cloudflare..."
61+
curl -s --socks5 127.0.0.1:40000 https://www.cloudflare.com/cdn-cgi/trace | grep warp
6562
}
6663

6764
func_check_warp() {
6865
while true; do
6966
sleep 10
70-
checker=$(printf "%s\n" $CHECKERS | shuf -n1)
71-
resp=$(curl -L --max-redirs 10 --socks5 127.0.0.1:${WARP_PORT} -s --max-time 30 "https://www.cloudflare.com/cdn-cgi/trace" 2>/dev/null | tr -d '\n\r' || true)
67+
resp=$(curl -L --max-redirs 10 --socks5 127.0.0.1:40000 -s --max-time 30 "https://www.cloudflare.com/cdn-cgi/trace" 2>/dev/null | tr -d '\n\r' || true)
7268
if echo "$resp" | grep -qi "warp=on"; then
73-
log "[INFO] WARP proxy is working: $resp"
69+
log "[OK] WARP proxy is working! Traffic is going through Cloudflare."
7470
return 0
7571
else
76-
log "[WARN] WARP proxy not ready, retrying..."
72+
log "[WAIT] WARP proxy not ready yet, checking again in 10 seconds..."
7773
fi
7874
done
7975
}
@@ -89,41 +85,48 @@ base {
8985
}
9086
redsocks {
9187
local_ip = 127.0.0.1;
92-
local_port = ${REDSOCKS_PORT};
88+
local_port = 50000;
9389
ip = 127.0.0.1;
94-
port = ${WARP_PORT};
90+
port = 40000;
9591
type = socks5;
9692
}
9793
EOF
9894
if [ "$SHOW_LOGS" = "true" ]; then
9995
cat /etc/redsocks.conf
10096
fi
101-
log "[INFO] Redsocks config written"
97+
log "[OK] Redsocks configuration saved to /etc/redsocks.conf"
10298
}
10399

104100
setup_iptables() {
105101
iptables -t nat -F
106102
iptables -t nat -A OUTPUT -p tcp -d 127.0.0.1 -j RETURN
107103
iptables -t nat -A OUTPUT -p tcp --dport 53 -j RETURN
108-
iptables -t nat -A OUTPUT -p tcp --dport ${REDSOCKS_PORT} -j RETURN
109-
iptables -t nat -A OUTPUT -p tcp --dport ${WARP_PORT} -j RETURN
104+
iptables -t nat -A OUTPUT -p tcp --dport 50000 -j RETURN
105+
iptables -t nat -A OUTPUT -p tcp --dport 40000 -j RETURN
110106
iptables -t nat -A OUTPUT -p udp -d 127.0.0.1 -j RETURN
111107
iptables -t nat -A OUTPUT -p udp --dport 53 -j RETURN
112-
iptables -t nat -A OUTPUT -p udp --dport ${REDSOCKS_PORT} -j RETURN
113-
iptables -t nat -A OUTPUT -p udp --dport ${WARP_PORT} -j RETURN
114-
iptables -t nat -A OUTPUT -p tcp -j REDIRECT --to-ports ${REDSOCKS_PORT}
115-
log "[INFO] iptables rules applied"
108+
iptables -t nat -A OUTPUT -p udp --dport 50000 -j RETURN
109+
iptables -t nat -A OUTPUT -p udp --dport 40000 -j RETURN
110+
iptables -t nat -A OUTPUT -p tcp -j REDIRECT --to-ports 50000
111+
log "[OK] iptables rules applied — all outbound traffic will go through WARP"
112+
}
113+
114+
func_expose_warp() {
115+
log "[EXPOSE] Opening WARP SOCKS5 on 0.0.0.0:40001 for external access..."
116+
socat TCP-LISTEN:40001,fork,reuseaddr TCP:127.0.0.1:40000 &
117+
log "[OK] WARP SOCKS5 now available at 0.0.0.0:40001"
116118
}
117119

118120
func_set_proxy() {
119-
log "[INFO] Initializing WARP + Redsocks proxy stack..."
121+
log "[START] Setting up full proxy stack (WARP + Redsocks + iptables)..."
120122

121123
pkill -f warp-svc || true
122124
pkill -f warp-cli || true
123125
sleep 2
124126

125127
func_start_warp
126128
func_check_warp
129+
func_expose_warp
127130
setup_redsocks
128131
setup_iptables
129132

@@ -138,21 +141,22 @@ func_set_proxy() {
138141
checker=$(printf "%s\n" $CHECKERS | shuf -n1)
139142
resp=$(curl -L --max-redirs 10 -s --max-time 30 "https://${checker}" || true)
140143
if [ -n "$resp" ]; then
141-
log "[INFO] Global proxy via redsocks is working: $resp (via $checker)"
144+
log "[OK] Global proxy is working! Your IP: $resp (checked via $checker)"
142145
touch /tmp/redsocks.ready
143146
return 0
144147
else
145-
log "[ERROR] Global proxy test failed"
148+
log "[FAIL] Global proxy test failed — no internet through the proxy"
146149
return 1
147150
fi
148151
}
149152

150153
func_global_monitor() {
151154
while true; do
152-
log "[INFO] Cleaning up WARP and Redsocks..."
155+
log "[RESTART] Shutting down old WARP and Redsocks processes..."
153156
pkill -f warp-svc || true
154157
pkill -f warp-cli || true
155158
pkill -f redsocks || true
159+
pkill -f socat || true
156160
rm -f /tmp/redsocks.ready || true
157161

158162
func_set_proxy || { sleep 60; continue; }
@@ -163,14 +167,14 @@ func_global_monitor() {
163167
checker=$(printf "%s\n" $CHECKERS | shuf -n1)
164168
resp=$(curl -L --max-redirs 10 -s --max-time 30 "https://${checker}" 2>/dev/null | tr -d '\n\r' || true)
165169
if [ -n "$resp" ]; then
166-
log "[GOOD] Global monitor check OK: $resp (via $checker)"
170+
log "[OK] Internet check passed — your IP: $resp (via $checker)"
167171
proxy_fail_count=0
168172
else
169173
proxy_fail_count=$((proxy_fail_count+1))
170-
log "[ERROR] Proxy failure detected (consecutive fails: ${proxy_fail_count})"
174+
log "[WARN] Internet check failed (${proxy_fail_count}/3 failures)"
171175
fi
172176
if [ ${proxy_fail_count} -ge 3 ]; then
173-
log "[CRITICAL] Proxy failed 3 times in a row, restarting full stack..."
177+
log "[RESTART] 3 internet checks failed — restarting the whole proxy stack..."
174178
break
175179
fi
176180
done

0 commit comments

Comments
 (0)