4 ms·

I've got 3 low quality VPSs, priced from $0.99 to $2.50 per month, that I picked up on a whim over the years from deals posted to http://www.lowendbox.com http:

I've got 3 low quality VPSs, priced from $0.99 to $2.50 per month, that I picked up on a whim over the years from deals posted to http://www.lowendbox.com http://www.lowendbox.com (no affiliation). On one server, I have squid running and bound to localhost. On my machine, I have autossh set up to maintain a constant port-forwarding connection established (via port 443 for maximum firewall/filter accessibility) with the squid server. I have my local web browsers proxying over that connection. So I'm pretty safe from snooping by my employer, home ISP, or whatever 133t hackers are sniffing traffic at McDonald's when I'm browsing and sipping a coffee. It's not the most elegant solution, but it does the trick. I supposed some day I'll mess around with OpenVPN (which I have deployed before, and do really like), but only when I'm bored or otherwise have nothing else better to do with my time.

dustingetz 15y ago
this is a fine solution, and what i've used before. it's worth pointing out that you only gain privacy for browsers and apps that _choose_ to use IE's proxy settings. your native IM client, even if it is using HTTP, may or may not use the proxy. Your remote desktop client probably isn't using HTTP so it can't use the proxy. with VPN you just don't care, all network traffic is routed through the VPN at network-driver level.
- coderrr 15y ago
  One interesting benefit of using a local proxy tunnel (instead of VPN) is that you get rid of one round trip when making TCP connections. Since your browser will connect to localhost (~0ms) it will be able to send the HTTP request immediately rather than having to wait for a connection to be established to a remote host. Whether this actually ends up being faster or not depends on the distance between you and your proxy server and your proxy server and the remote host you're connecting to.
drivebyacct2 15y ago
IM clients, anything that sends UDP, DNS requests are all possibly and probably leaking out.
- catch23 15y ago
  At least on OSX, that isn't the case. Even the DNS requests are being proxied through the tunnel.
  - drivebyacct2 15y ago
    Where are you setting the proxy at, and what method of proxying are you using?
coderrr 15y ago
Just fyi, all your non-HTTP Flash traffic (Flash sockets) is probably not being proxied at all. Even if you have a SOCKS proxy set in the browser. The easiest way around this is VPN, but you can also do crazier stuff like use ProxyCap (for windows or OSX) or iptables redirect/transocks setup in Linux: http://coderrr.wordpress.com/2009/07/29/how-to-force-flash-or-any-program-to-use-a-socks-proxy-using-transocks-and-iptables-in-linux/ http://coderrr.wordpress.com/2009/07/29/how-to-force-flash-o...
- tuomasb 15y ago
  Linux has tsocks and proxychains which override the connect() method with a LD_PRELOAD library and force traffic to go through a socks proxy. Easier than iptables since at least proxychains can be installed with apt-get on Ubuntu(don't know about other OSes).
  - coderrr 15y ago
    Only problem with the LD_PRELOAD method is that it doesn't work for all (many) apps. I believe one case it breaks for is non blocking connect()s, not sure if there are others. Although the iptables setup is a lot more complicated it pretty much works for everything.
    - keeperofdakeys 15y ago
      An example I have found is rtorrent. There is also https://github.com/apenwarr/sshuttle https://github.com/apenwarr/sshuttle, which looks promising, but I haven't used it. My vps provider doesn't provide tap for openvpn to work.
tuomasb 15y ago
Just a quick note. Make sure your VPS is Xen/KVM/Vmware and not OpenVZ or some other container based virtualization if you want to use OpenVPN since it needs access to tun/tap devices. On OpenVZ based virtual machines, the administrator has to specifically grant you that access, which might not be possible on a $1/month machine.
pieter 15y ago
I have the same, but then use sshuttle [1] for a quick secure connection. Only does TCP, but if that doesn't bother you you can get it set up in 2 minutes. [1] https://github.com/apenwarr/sshuttle https://github.com/apenwarr/sshuttle [2] For Lion: https://github.com/thatha/sshuttle/blob/macos_10_7_only_hack/README.md https://github.com/thatha/sshuttle/blob/macos_10_7_only_hack...
Nick_C 15y ago
I recently bought the same for $15/year. Care to share your squid.conf? I just want a non-caching anonymous forwarding proxy and am finding the huge amount of options a bit of a muddle to work through. Seeing yours would be a help, if you are ok with that.
- SageRaven 15y ago
  I think the only magic lines deviating from the defaults are: no_cache deny all forwarded_for off via off The first disables caching, and the last two are for a little extra privacy. You can verify if you're caching by checking your cache spool for files: find /var/spool/squid/ -type f

dustingetz 15y ago

this is a fine solution, and what i've used before. it's worth pointing out that you only gain privacy for browsers and apps that _choose_ to use IE's proxy settings. your native IM client, even if it is using HTTP, may or may not use the proxy. Your remote desktop client probably isn't using HTTP so it can't use the proxy. with VPN you just don't care, all network traffic is routed through the VPN at network-driver level.

coderrr 15y ago
One interesting benefit of using a local proxy tunnel (instead of VPN) is that you get rid of one round trip when making TCP connections. Since your browser will connect to localhost (~0ms) it will be able to send the HTTP request immediately rather than having to wait for a connection to be established to a remote host. Whether this actually ends up being faster or not depends on the distance between you and your proxy server and your proxy server and the remote host you're connecting to.

drivebyacct2 15y ago

IM clients, anything that sends UDP, DNS requests are all possibly and probably leaking out.

catch23 15y ago
At least on OSX, that isn't the case. Even the DNS requests are being proxied through the tunnel.
- drivebyacct2 15y ago
  Where are you setting the proxy at, and what method of proxying are you using?

coderrr 15y ago

Just fyi, all your non-HTTP Flash traffic (Flash sockets) is probably not being proxied at all. Even if you have a SOCKS proxy set in the browser. The easiest way around this is VPN, but you can also do crazier stuff like use ProxyCap (for windows or OSX) or iptables redirect/transocks setup in Linux: http://coderrr.wordpress.com/2009/07/29/how-to-force-flash-or-any-program-to-use-a-socks-proxy-using-transocks-and-iptables-in-linux/ http://coderrr.wordpress.com/2009/07/29/how-to-force-flash-o...

tuomasb 15y ago
Linux has tsocks and proxychains which override the connect() method with a LD_PRELOAD library and force traffic to go through a socks proxy. Easier than iptables since at least proxychains can be installed with apt-get on Ubuntu(don't know about other OSes).
- coderrr 15y ago
  Only problem with the LD_PRELOAD method is that it doesn't work for all (many) apps. I believe one case it breaks for is non blocking connect()s, not sure if there are others. Although the iptables setup is a lot more complicated it pretty much works for everything.
  - keeperofdakeys 15y ago
    An example I have found is rtorrent. There is also https://github.com/apenwarr/sshuttle https://github.com/apenwarr/sshuttle, which looks promising, but I haven't used it. My vps provider doesn't provide tap for openvpn to work.

tuomasb 15y ago

Just a quick note. Make sure your VPS is Xen/KVM/Vmware and not OpenVZ or some other container based virtualization if you want to use OpenVPN since it needs access to tun/tap devices. On OpenVZ based virtual machines, the administrator has to specifically grant you that access, which might not be possible on a $1/month machine.

pieter 15y ago

I have the same, but then use sshuttle [1] for a quick secure connection. Only does TCP, but if that doesn't bother you you can get it set up in 2 minutes. [1] https://github.com/apenwarr/sshuttle https://github.com/apenwarr/sshuttle [2] For Lion: https://github.com/thatha/sshuttle/blob/macos_10_7_only_hack/README.md https://github.com/thatha/sshuttle/blob/macos_10_7_only_hack...

Nick_C 15y ago

I recently bought the same for $15/year. Care to share your squid.conf? I just want a non-caching anonymous forwarding proxy and am finding the huge amount of options a bit of a muddle to work through. Seeing yours would be a help, if you are ok with that.

SageRaven 15y ago
I think the only magic lines deviating from the defaults are: no_cache deny all forwarded_for off via off The first disables caching, and the last two are for a little extra privacy. You can verify if you're caching by checking your cache spool for files: find /var/spool/squid/ -type f