3 ms·

Very cool! So if I assume that my ISP is recording/selling my browsing history, including which sites I visit, would this setup prevent me from being snooped on

Very cool! So if I assume that my ISP is recording/selling my browsing history, including which sites I visit, would this setup prevent me from being snooped on? I don't know if DNS goes over the socks5

gigel82 5y ago
SOCKS5 does not encrypt traffic, so if you put in a public / internet SOCKS5 server address that won't prevent snooping. If you have a spare Raspberry Pi (perhaps running PiHole / AdGuard as well which takes care of DNS security and ad-blocking on top), or another server running you can spin up a Docker (or VM/or baremetal) with an OpenVPN / WireGuard client and a SOCKS5 proxy. For example, in my setup I use the "dperson/openvpn-client" and "serjs/go-socks5-proxy" docker images (set the socks5 container to use the network of the vpn client, and expose the socks5 port out of the vpn container). You should explore whatever option works best for your home and VPN setups.
- TedDoesntTalk 5y ago
  SOCKS5 does support tunneling of DNS lookups. The FoxyProxy addon for Firefox has that option when you configure it to use a SOCKS5 server.
  - gigel82 5y ago
    SOCKS5, the protocol, is not encrypted. Data is sent in clear text across the wire and can be intercepted at any time. Of course, the data is just TCP and UDP packets, so you could be running a HTTPS connection over it (or DOH for DNS) but from the ISP's point of view SOCKS5 or no SOCKS5 they can see just as much of your traffic. SOCKS5 to an external server is not solving encryption, you need a VPN for that; at most, it can solve anonymity (by hiding your IP address, presuming you trust the SOCKS5 server operator). In my case, I'm using SOCKS5 to another machine in my LAN which in turn connects to an external VPN provider over an encrypted channel (OpenVPN or WireGuard).
    - tjoff 5y ago
      That is true, however for "personal use" one of the popular uses of a socks proxy is to create a local socks server using ssh. Works on all big desktop platforms (on windows puttys plink.exe works fine, not sure if the inbuilt client has it but I'd guess it does too) and often with already installed tools and only need a server with SSH, and is encrypted. And that is far more common than having a VPN, and again, might not even need to install anything on the client. So you could quickly configure a friends laptop to ssh+socks inside your own network to stream from a local jellyfin server, or whatever. Or bypass language restrictions on regional services when you are abroad on vacation etc. (all are trivial to do with a VPN of course, but this is quite handy when you normally don't have a need for a VPN and/or just want something quick with tools and accounts you know at the back of your mind). https://bash-prompt.net/guides/ssh-firefox-tunnel/ https://bash-prompt.net/guides/ssh-firefox-tunnel/
    - TedDoesntTalk 5y ago
      I was not commenting about encryption at all. Only that SOCKS5 supports DNS.
- kibwen 5y ago
  If you only want to encrypt browser traffic and you have access to a cloud server then you don't need to go full VPN, Firefox has built-in support for SOCKS proxying. Configure it to proxy on localhost:12345, then `ssh -D 12345 example.com` and now your browser traffic will originate from whatever server you've SSH'd into, no need to install anything on the remote server at all.

gigel82 5y ago

SOCKS5 does not encrypt traffic, so if you put in a public / internet SOCKS5 server address that won't prevent snooping. If you have a spare Raspberry Pi (perhaps running PiHole / AdGuard as well which takes care of DNS security and ad-blocking on top), or another server running you can spin up a Docker (or VM/or baremetal) with an OpenVPN / WireGuard client and a SOCKS5 proxy. For example, in my setup I use the "dperson/openvpn-client" and "serjs/go-socks5-proxy" docker images (set the socks5 container to use the network of the vpn client, and expose the socks5 port out of the vpn container). You should explore whatever option works best for your home and VPN setups.

TedDoesntTalk 5y ago
SOCKS5 does support tunneling of DNS lookups. The FoxyProxy addon for Firefox has that option when you configure it to use a SOCKS5 server.
- gigel82 5y ago
  SOCKS5, the protocol, is not encrypted. Data is sent in clear text across the wire and can be intercepted at any time. Of course, the data is just TCP and UDP packets, so you could be running a HTTPS connection over it (or DOH for DNS) but from the ISP's point of view SOCKS5 or no SOCKS5 they can see just as much of your traffic. SOCKS5 to an external server is not solving encryption, you need a VPN for that; at most, it can solve anonymity (by hiding your IP address, presuming you trust the SOCKS5 server operator). In my case, I'm using SOCKS5 to another machine in my LAN which in turn connects to an external VPN provider over an encrypted channel (OpenVPN or WireGuard).
  - tjoff 5y ago
    That is true, however for "personal use" one of the popular uses of a socks proxy is to create a local socks server using ssh. Works on all big desktop platforms (on windows puttys plink.exe works fine, not sure if the inbuilt client has it but I'd guess it does too) and often with already installed tools and only need a server with SSH, and is encrypted. And that is far more common than having a VPN, and again, might not even need to install anything on the client. So you could quickly configure a friends laptop to ssh+socks inside your own network to stream from a local jellyfin server, or whatever. Or bypass language restrictions on regional services when you are abroad on vacation etc. (all are trivial to do with a VPN of course, but this is quite handy when you normally don't have a need for a VPN and/or just want something quick with tools and accounts you know at the back of your mind). https://bash-prompt.net/guides/ssh-firefox-tunnel/ https://bash-prompt.net/guides/ssh-firefox-tunnel/
  - TedDoesntTalk 5y ago
    I was not commenting about encryption at all. Only that SOCKS5 supports DNS.
kibwen 5y ago
If you only want to encrypt browser traffic and you have access to a cloud server then you don't need to go full VPN, Firefox has built-in support for SOCKS proxying. Configure it to proxy on localhost:12345, then `ssh -D 12345 example.com` and now your browser traffic will originate from whatever server you've SSH'd into, no need to install anything on the remote server at all.