4 ms·
Even ISPs will do all sorts of obnoxious things like this, although some public wifi is horrible. I got a $15/year ramnode VPS about a year and a half ago and
by joveian 10y ago
Even ISPs will do all sorts of obnoxious things like this, although some public wifi is horrible. I got a $15/year ramnode VPS about a year and a half ago and removed all services except ssh on port 80 with chacha/poly1305 and public key encryption. I mostly use SOCKS with sshuttle to catch anything not configured for SOCKS (sshuttle in theory is a better method, but in practice it leaks DNS requests somehow). Quite simple and I highly recommend it. Traffic accounting seems to undercount substantially with this usage so I didn't get anywhere near my limit (I don't have the highest bandwidth usage, but not the smallest either). One public wifi I would like to use more often somehow manages to break this setup (and half the internet even without a VPN so no idea what they are doing), but I haven't had trouble anywhere else. I started doing this after getting SSL downgrade errors using public wifi.
- pbhjpbhj 10y ago>(sshuttle in theory is a better method, but in practice it leaks DNS requests somehow // Even when specifically shuttling the DNS with the --dns option? Is that a reported bug?
- joveian 10y agoYes, even with the --dns option, although only with the default method. tproxy mode might (most likely would?) fix it. I tried it once and it didn't work at all, but I have since learned that I did it wrong since you need to explicitly exclude the address you are connecting to. I didn't report it since I didn't gather enough information to make a particularly useful report. It is at least known that FreeBSD has an issue with DNS forwarding (that might be the same?), although I am on arch. I hope to look into it more at some point.