Encontrou uma solução, uma que funciona com base no método B) :
Para pacotes de entrada na cadeia nat da PREROUTING table, eu estava tentando filtrar como abaixo
$nat PREROUTING -p tcp -s XXX.XXX.XXX.XXX $to_enabled_port \
-j $REDIRECT
onde a opção -s e o valor do IP são depois de -p tcp . Então mudei para
$nat PREROUTING -s XXX.XXX.XXX.XXX -p tcp $to_enabled_port \
-j $REDIRECT
Com essa alteração e modificação da OUTPUT chain de nat , os resultados desejados foram alcançados.
Curiosamente, a saída de iptables -t nat --line-numbers -L -nv parece exatamente a mesma para qualquer um dos comandos acima. Ainda assim, apenas o segundo produz resultados de acordo com minhas restrições.
Aqui é a versão modificada de iptables.sh , que permite especificar um ou mais IPs para restringir o tcpcrypt.
Veja FILTER_IP abaixo.
#!/bin/sh
#DAEMON_USER DIVERT_PORT ONLY_PORTS OMIT_PORTS
# determine which operation is requested (Append or Delete)
if [ "" = "start" -o -z "" ]; then
# during startup, bail early if any of these commands fails
set -e
OP="-A"
elif [ "" = "stop" -o "" = "-f" ] ; then
OP="-D"
else
echo "Expected \"start\" or \"stop\" as first argument" >&2
exit 1
fi
# determine which ports should be tcpcrypt-enabled
if [ -z "$ONLY_PORTS" -a -z "$OMIT_PORTS" ] ; then
echo "Expected either OMIT_PORTS or ONLY_PORTS environment variables to be set" >&2
exit 1
fi
if [ -n "$ONLY_PORTS" -a -n "$OMIT_PORTS" ] ; then
echo "Expected only one of OMIT_PORTS or ONLY_PORTS environment variables to be set" >&2
exit 1
fi
if [ -n "$OMIT_PORTS" ] ; then
PORT_TEST=!
PORTS="$OMIT_PORTS"
fi
if [ -n "$ONLY_PORTS" ] ; then
PORT_TEST=
PORTS="$ONLY_PORTS"
fi
# more necessary configuration
if [ -z "$DAEMON_USER" ] ; then
echo "Expected DAEMON_USER environment variable to be set" >&2
exit 1
fi
if [ -z "$DIVERT_PORT" ] ; then
echo "Expected DIVERT_PORT environment variable to be set" >&2
exit 1
fi
# some shorthand to make rules more concise
from_enabled_port="-m multiport $PORT_TEST --source-ports $PORTS"
to_enabled_port="-m multiport $PORT_TEST --destination-ports $PORTS"
NFQUEUE="NFQUEUE --queue-num $DIVERT_PORT"
CRYPT_PORT="65530"
REDIRECT="REDIRECT --to-port $CRYPT_PORT"
INJECT_TOS="0x22"
HANDSHAKE_TOS="0x04"
# You can specify multiple IPs, or a IP range accrding to required format
# For example, restricting tcpcrypt to 192.192.192.192 and 127.127.127.127
# FILTER_IP="192.192.192.192,127.127.127.127"
# See iptables manpage for more info
FILTER_IP="XXX.XXX.XXX.XXX"
filter="$ECHO iptables -t filter $OP"
# Injection from daemon: Accept
$filter INPUT -i lo -p tcp --dport $CRYPT_PORT \
-m tos --tos $INJECT_TOS \
-j ACCEPT
# SYN redirected to daemon:
# Queue for daemon to initiate proxy connection with original destination
$filter INPUT -p tcp --dport $CRYPT_PORT --tcp-flags ALL SYN \
-j $NFQUEUE
# SYN+ACK on proxy connection:
# Queue for daemon to complete original handshake
$filter INPUT -p tcp $from_enabled_port --tcp-flags ALL SYN,ACK \
-j $NFQUEUE
# Handshake packet of proxy connection from daemon:
# Queue for daemon to set tcp options via DIVERT_MODIFY
$filter OUTPUT -p tcp $to_enabled_port \
-m tos --tos $HANDSHAKE_TOS \
-m owner --uid-owner $DAEMON_USER \
-j $NFQUEUE
# SYN+ACK on redirected connection:
# Queue for daemon to delay handshake until proxy connection succeeds
$filter OUTPUT -p tcp --sport $CRYPT_PORT --tcp-flags ALL SYN,ACK \
-j $NFQUEUE
nat="$ECHO iptables -t nat $OP"
# Inbound connection for enabled ports:
# Redirect to daemon (at localhost:$CRYPT_PORT) for encryption
#
# (The nat module will now translate addresses in both directions,
# for the lifetime of this connection.)
$nat PREROUTING -s $FILTER_IP -p tcp $to_enabled_port \
-j $REDIRECT
# Proxy connection from daemon to enabled port: Accept
$nat OUTPUT -p tcp $to_enabled_port \
-m owner --uid-owner $DAEMON_USER \
-j ACCEPT
# Outbound connections to enabled ports on remote hosts:
# Redirect to daemon (at localhost port $CRYPT_PORT) for encryption
#
# (The nat module will now translate addresses in both directions,
# for the lifetime of this connection.)
$nat OUTPUT -d $FILTER_IP \! -o lo -p tcp $to_enabled_port \
-j $REDIRECT
mangle="$ECHO iptables -t mangle $OP"
# Packets leaving the machine with bookkeeping mark: Remove mark
$mangle POSTROUTING -m tos --tos $HANDSHAKE_TOS \
-j TOS --set-tos 0x00