3 ms·

[note I am wrong here - it doesn't support UDP - see below] The ssh SOCKS proxy supports UDP. I use Firefox with a SOCKS proxy via ssh (e.g. ssh -D 2222 hostna

by xioxox 6y ago

[note I am wrong here - it doesn't support UDP - see below] The ssh SOCKS proxy supports UDP. I use Firefox with a SOCKS proxy via ssh (e.g. ssh -D 2222 hostname) to get around geoblocking and accessing papers via an institutional account. The tsocks program can also let you use a SOCKS proxy for an arbitrary command in linux. I find it much more convenient than a VPN, as it can be easily applied to single programs.

cryo 6y ago
Are you about this? Last time I've checked SSH SOCKS5 only supports TCP traffic, UDP isn't supported and needs extra steps through tools like socat to wrap UDP in TCP. http://lists.mindrot.org/pipermail/openssh-unix-dev/2017-January/035662.html http://lists.mindrot.org/pipermail/openssh-unix-dev/2017-Jan...
- xioxox 6y ago
  It looks like I was wrong about UDP being supported by ssh. Sorry about misleading everyone. I've verified with nc that it doesn't actually forward UDP. I'm amazed that streaming media over this seems to work fine on most sites, though.
  - lxgr 6y ago
    Many applications these days can fall back to TCP because UDP is often blocked (almost never for good reasons, but that's another discussion). For real-time applications, that fallback usually comes with a loss in quality/interactivity, though. Alternatively, you might be unknowingly using un-proxied UDP: Many AV systems only enforce IP restrictions on the signalling protocol (which is often TCP); the actual media can then take whatever path it wants. By the way, it seems like you can forward UDP over sshuttle [1] when used with tproxy (which seems to be a Linux-only feature)! [1] https://sshuttle.readthedocs.io/en/stable/tproxy.html https://sshuttle.readthedocs.io/en/stable/tproxy.html
lxgr 6y ago
For single applications that are able to "cooperate" with being proxied, a proxy server can make much more sense than a VPN, yes. The less cooperative your applications are (even though cooperation can be somewhat enforced using tsocks, as you mention, which can be further made to apply system-wide using sshuttle [1]), the more a VPN will start to make sense. [1] https://github.com/sshuttle/sshuttle https://github.com/sshuttle/sshuttle
throw0101a 6y ago
Note that the default port for SOCKS(5) is 1080, and the de facto standard for (forward) web proxies (e.g., Squid) is 3128, so one may want to make of habit of using one of those ports.
- iso1210 6y ago
  3128 is a common http/s proxy sure, but so is 8080, and I've seen 80 a few times too. 1080 is often default for socks, but I've also seen places where it's 1085 (for socks5 -- 1084 for socks4) Ultimately it can be whatever you want.

by xioxox 6y ago

cryo 6y ago

Are you about this? Last time I've checked SSH SOCKS5 only supports TCP traffic, UDP isn't supported and needs extra steps through tools like socat to wrap UDP in TCP. http://lists.mindrot.org/pipermail/openssh-unix-dev/2017-January/035662.html http://lists.mindrot.org/pipermail/openssh-unix-dev/2017-Jan...

xioxox 6y ago
It looks like I was wrong about UDP being supported by ssh. Sorry about misleading everyone. I've verified with nc that it doesn't actually forward UDP. I'm amazed that streaming media over this seems to work fine on most sites, though.
- lxgr 6y ago
  Many applications these days can fall back to TCP because UDP is often blocked (almost never for good reasons, but that's another discussion). For real-time applications, that fallback usually comes with a loss in quality/interactivity, though. Alternatively, you might be unknowingly using un-proxied UDP: Many AV systems only enforce IP restrictions on the signalling protocol (which is often TCP); the actual media can then take whatever path it wants. By the way, it seems like you can forward UDP over sshuttle [1] when used with tproxy (which seems to be a Linux-only feature)! [1] https://sshuttle.readthedocs.io/en/stable/tproxy.html https://sshuttle.readthedocs.io/en/stable/tproxy.html

lxgr 6y ago

For single applications that are able to "cooperate" with being proxied, a proxy server can make much more sense than a VPN, yes. The less cooperative your applications are (even though cooperation can be somewhat enforced using tsocks, as you mention, which can be further made to apply system-wide using sshuttle [1]), the more a VPN will start to make sense. [1] https://github.com/sshuttle/sshuttle https://github.com/sshuttle/sshuttle

throw0101a 6y ago

Note that the default port for SOCKS(5) is 1080, and the de facto standard for (forward) web proxies (e.g., Squid) is 3128, so one may want to make of habit of using one of those ports.

iso1210 6y ago
3128 is a common http/s proxy sure, but so is 8080, and I've seen 80 a few times too. 1080 is often default for socks, but I've also seen places where it's 1085 (for socks5 -- 1084 for socks4) Ultimately it can be whatever you want.