6 ms·

Also adding to this - you can set up container-specific proxies with "Container proxy" addon. This is great for when you want to ensure your connection is goin

Also adding to this - you can set up container-specific proxies with "Container proxy" addon. This is great for when you want to ensure your connection is going over a private network, for instance if you have a regular torrent website (or porn or whatever) - you can configure it to automatically open in a container, like this Facebook addon - but when it opens - it will only connect to the endpoint over a proxy. If you're not connected, it fails. Works really well with Mullvad which has a SOCKS proxy setup only available when connected. Great for work connections too, I've setup all work/business websites to auto-open in a "work" container which I've created a local bridge proxy for to ensure my work connections are always over the corporate VPN. This is also really good if you consult or work with many customers - you can start to build a catalogue of containers with specific settings for those customers. Container Proxy addon: https://addons.mozilla.org/en-US/firefox/addon/container-proxy/ https://addons.mozilla.org/en-US/firefox/addon/container-pro...

hannibalhorn 6y ago
I use the same setup (mullvad + container proxy) and can't praise it enough. I just keep a mullvad connection open on my router and only route the proxy IPs through it. Great for all kinds of silly GeoIP restrictions, too - in my part of the world, homedepot.com just spits out "access denied", a foodnetwork.com recipe you find in search results just redirects you to the tudiscovery.com homepage, etc.
- bogomipz 6y ago
  >"I just keep a mullvad connection open on my router and only route the proxy IPs through it.' I'm interested in your setup. Do you configure your router to have a point to point tunnel with Mullvad then? I didn't know this was a thing. Do you then just have a separate container proxy for each GeoIP region you want to access?
  - Mandatum 6y ago
    This'll help you: https://mullvad.net/en/help/dd-wrt-routers-and-mullvad-vpn/ https://mullvad.net/en/help/dd-wrt-routers-and-mullvad-vpn/ For Geo-IP, unfortunately unless you have some sort of automation to reconfigure the OpenVPN settings on your router - this will only work with 1 configuration. They may be alluding to using the VPN to connect to another country where they're not getting weird as fuck redirects and shit content. Although just as I wrote that, I'm expecting a dd-wrt/browser addon will probably support this somewhere - or at least as a script on Linux.
  - hannibalhorn 6y ago
    I have a Unifi USG, which has a third party wireguard addon, though of course OpenWRT could work just fine. You setup a wireguard tunnel normally, but disable the default routing (on a Unifi, set route-allowed-ip false), and then explicitly add a route for 10.124.0.0/16 through the wireguard interface. The mullvad servers page[1] has socks 5 proxy addresses for all of their servers - assign one to a firefox container and you're all set. No reason you couldn't have a container for each geographic region you want. 1. https://mullvad.net/en/servers/ https://mullvad.net/en/servers/ On a USG the config looks like this: wireguard wg0 { address ***/32 mtu 1420 peer *** { allowed-ips 0.0.0.0/0 endpoint ***:51820 } private-key *** route-allowed-ips false up-command "ip route add 10.64.0.1/32 dev wg0 && ip route add 10.124.0.0/16 dev wg0" }
    - angrais 6y ago
      I'm curious to learn more why you have gone this route compared with the default settings of a standard router? I'm uncertain of the benefit for everyday people.
smichel17 6y ago
Anyone in the know: what would it take to implement a "container over tor"? I am not currently a tor user, but absolutely would if I could integrate it with my current workflow (using the temporary containers addon).
- hannibalhorn 6y ago
  tor provides a socks proxy, which you can assign to a container easy enough w/ the container proxy addon.
  - smichel17 6y ago
    Thank you, I'll look in to this!
    - breakingcups 6y ago
      Be careful doing this though, there's a reason Tor Browser exists and it is because it's very hard to do anonimity over Tor right on a default browser. Granted, Tor tries to upstream as much as it reasonably can to FF, but there's still large differences in defaults that could give away (some bits of) your identity.
      - smichel17 6y ago
        See this comment first, not mine but might as well be https://news.ycombinator.com/item?id=24853678 https://news.ycombinator.com/item?id=24853678 It's all baby steps. I don't expect to be fully anonymous this way, just like I know my current setup does not foil more sophisticated tracking.
  - aasasd 6y ago
    Does FF send DNS requests via the proxy? Depending on the personal threat model and the ISP, that might matter.
    - TheFlyingFish 6y ago
kbenson 6y ago
Container proxy plus a putty socks tunnel over SSH through a pinhole firewall rules to my work linux system is my preferred poor man's work VPN. One main benefit being that allowing the non-VPN traffic to handle the video meeting works way better.
- raverbashing 6y ago
  I'd even debate if it's really a "poor man's" VPN, I think it's actually a better solution Traditional VPN solutions seem overengineered and complicated. Wireguard is better though
seszett 6y ago
I just discovered Mullvad (just a VPN provider) and for some reason, they don't have "English" in the list of languages available for their site. So they redirected me to the Dutch version because I'm in a nominally Dutch-speaking region, and I had no option to get it in English. I had to go with half-translated French until I noticed that I could replace the "fr" in the URL with "en", and actually get to an English-language website. The region-based redirection was annoying enough, and the half-assed translation job was expected, but not even providing an easy way to get back to English is really idiotic. I still wish I had some kind of system that would automatically use a connection in the right country for geoblocked content. For now I just use SSH proxies to (my own) strategically located servers combined with Firefox Containers and Container Proxies, but it's all manual.
- pzmarzly 6y ago
  Just checked it, and English is 4th option in the language switcher on the bottom of the page. Also, it seems to be using browser's preferred locale, not the IP region. So, it looks like that changed, too. Google, on the other hand, is just as bad as you described. Geo-based localisation, lots of clicks to change the language (or ?hl=en, once you learn about it).
  - seszett 6y ago
    Looks like you're right, but unfortunately the select is cut for me[0] because my screen is not big enough. Since the list is not alphabetically ordered (it actually is, but with the English names, not the displayed names) and it shows no scrollbar, it wasn't obvious there would be other countries up there. As for language, maybe Google itself chose to send me to the Dutch version. Despite all my attempts, I still cannot consistently get Google to use the language I want (apart from manually choosing it by directly visiting Google with the right hl= first, indeed). Right now Google.fr seems to be in English and offering me the three languages of Belgium, for some reason. [0]https://i.imgur.com/nuAPsxD.png https://i.imgur.com/nuAPsxD.png
CartenLoor 6y ago
Could you provide some more information about the local bridge proxy? I'm trying to implement something similar but don't know where to start.
s__s 6y ago
Mozilla needs to work harder on the permission system for addons. One of the permissions you have to grant to the container proxy add on is: “Access your data for all websites” That’s not acceptable.
- BHSPitMonkey 6y ago
  How would you propose fixing it? Firefox has an active bug tracker to discuss these kinds of things.

hannibalhorn 6y ago

I use the same setup (mullvad + container proxy) and can't praise it enough. I just keep a mullvad connection open on my router and only route the proxy IPs through it. Great for all kinds of silly GeoIP restrictions, too - in my part of the world, homedepot.com just spits out "access denied", a foodnetwork.com recipe you find in search results just redirects you to the tudiscovery.com homepage, etc.

bogomipz 6y ago
>"I just keep a mullvad connection open on my router and only route the proxy IPs through it.' I'm interested in your setup. Do you configure your router to have a point to point tunnel with Mullvad then? I didn't know this was a thing. Do you then just have a separate container proxy for each GeoIP region you want to access?
- Mandatum 6y ago
  This'll help you: https://mullvad.net/en/help/dd-wrt-routers-and-mullvad-vpn/ https://mullvad.net/en/help/dd-wrt-routers-and-mullvad-vpn/ For Geo-IP, unfortunately unless you have some sort of automation to reconfigure the OpenVPN settings on your router - this will only work with 1 configuration. They may be alluding to using the VPN to connect to another country where they're not getting weird as fuck redirects and shit content. Although just as I wrote that, I'm expecting a dd-wrt/browser addon will probably support this somewhere - or at least as a script on Linux.
- hannibalhorn 6y ago
  I have a Unifi USG, which has a third party wireguard addon, though of course OpenWRT could work just fine. You setup a wireguard tunnel normally, but disable the default routing (on a Unifi, set route-allowed-ip false), and then explicitly add a route for 10.124.0.0/16 through the wireguard interface. The mullvad servers page[1] has socks 5 proxy addresses for all of their servers - assign one to a firefox container and you're all set. No reason you couldn't have a container for each geographic region you want. 1. https://mullvad.net/en/servers/ https://mullvad.net/en/servers/ On a USG the config looks like this: wireguard wg0 { address ***/32 mtu 1420 peer *** { allowed-ips 0.0.0.0/0 endpoint ***:51820 } private-key *** route-allowed-ips false up-command "ip route add 10.64.0.1/32 dev wg0 && ip route add 10.124.0.0/16 dev wg0" }
  - angrais 6y ago
    I'm curious to learn more why you have gone this route compared with the default settings of a standard router? I'm uncertain of the benefit for everyday people.

smichel17 6y ago

Anyone in the know: what would it take to implement a "container over tor"? I am not currently a tor user, but absolutely would if I could integrate it with my current workflow (using the temporary containers addon).

hannibalhorn 6y ago
tor provides a socks proxy, which you can assign to a container easy enough w/ the container proxy addon.
- smichel17 6y ago
  Thank you, I'll look in to this!
  - breakingcups 6y ago
    Be careful doing this though, there's a reason Tor Browser exists and it is because it's very hard to do anonimity over Tor right on a default browser. Granted, Tor tries to upstream as much as it reasonably can to FF, but there's still large differences in defaults that could give away (some bits of) your identity.
    - smichel17 6y ago
      See this comment first, not mine but might as well be https://news.ycombinator.com/item?id=24853678 https://news.ycombinator.com/item?id=24853678 It's all baby steps. I don't expect to be fully anonymous this way, just like I know my current setup does not foil more sophisticated tracking.
- aasasd 6y ago
  Does FF send DNS requests via the proxy? Depending on the personal threat model and the ISP, that might matter.
  - TheFlyingFish 6y ago

kbenson 6y ago

Container proxy plus a putty socks tunnel over SSH through a pinhole firewall rules to my work linux system is my preferred poor man's work VPN. One main benefit being that allowing the non-VPN traffic to handle the video meeting works way better.

raverbashing 6y ago
I'd even debate if it's really a "poor man's" VPN, I think it's actually a better solution Traditional VPN solutions seem overengineered and complicated. Wireguard is better though

seszett 6y ago

I just discovered Mullvad (just a VPN provider) and for some reason, they don't have "English" in the list of languages available for their site. So they redirected me to the Dutch version because I'm in a nominally Dutch-speaking region, and I had no option to get it in English. I had to go with half-translated French until I noticed that I could replace the "fr" in the URL with "en", and actually get to an English-language website. The region-based redirection was annoying enough, and the half-assed translation job was expected, but not even providing an easy way to get back to English is really idiotic. I still wish I had some kind of system that would automatically use a connection in the right country for geoblocked content. For now I just use SSH proxies to (my own) strategically located servers combined with Firefox Containers and Container Proxies, but it's all manual.

pzmarzly 6y ago
Just checked it, and English is 4th option in the language switcher on the bottom of the page. Also, it seems to be using browser's preferred locale, not the IP region. So, it looks like that changed, too. Google, on the other hand, is just as bad as you described. Geo-based localisation, lots of clicks to change the language (or ?hl=en, once you learn about it).
- seszett 6y ago
  Looks like you're right, but unfortunately the select is cut for me[0] because my screen is not big enough. Since the list is not alphabetically ordered (it actually is, but with the English names, not the displayed names) and it shows no scrollbar, it wasn't obvious there would be other countries up there. As for language, maybe Google itself chose to send me to the Dutch version. Despite all my attempts, I still cannot consistently get Google to use the language I want (apart from manually choosing it by directly visiting Google with the right hl= first, indeed). Right now Google.fr seems to be in English and offering me the three languages of Belgium, for some reason. [0]https://i.imgur.com/nuAPsxD.png https://i.imgur.com/nuAPsxD.png

CartenLoor 6y ago

Could you provide some more information about the local bridge proxy? I'm trying to implement something similar but don't know where to start.

s__s 6y ago

Mozilla needs to work harder on the permission system for addons. One of the permissions you have to grant to the container proxy add on is: “Access your data for all websites” That’s not acceptable.

BHSPitMonkey 6y ago
How would you propose fixing it? Firefox has an active bug tracker to discuss these kinds of things.