5 ms·

So at this point it is ready for passing traffic through a SOCKS proxy. Meaning we can `cargo run --release -- proxy` and redirect applications to use port `915

So at this point it is ready for passing traffic through a SOCKS proxy. Meaning we can `cargo run --release -- proxy` and redirect applications to use port `9150` for their network connections. Couple of related questions: - Does anyone know, in a Linux distro, how to pass all system traffic through a SOCKS proxy port? I'm not looking for intermediary proxy handlers but an official method to force all user and system apps to use an arbitrary port. - If it is not possible to do so, does `NetworkManager` have a setting for this? - Is it possible to at least change Chrome/Firefox ports via CLI to an arbitrary port?

koblas 5y ago
Isn't that just NAT through a SOCKS proxy as transport. Never would have imaged that use case.
- qersist3nce 5y ago
  >Never would have imaged that use case. circumventing censorship and geo-restrictions?
  - koblas 5y ago
    Let me clarify -- I never would have imagined SOCKS being used for this use case. There was no such thing as geo-restrictions or censorship at the time on the internet.
guerby 5y ago
The way it's done is described here: https://unix.stackexchange.com/questions/166692/how-does-a-transparent-socks-proxy-know-which-destination-ip-to-use https://unix.stackexchange.com/questions/166692/how-does-a-t... A part from tor I don't know if there's a generic tool packaging this.
- guerby 5y ago
  Found one here: https://hev.cc/3033.html https://hev.cc/3033.html https://github.com/heiher/hev-socks5-tproxy https://github.com/heiher/hev-socks5-tproxy
e12e 5y ago
I don't think you can generally expect all processes to transparently use a SOCKS proxy? You might be able to finagle a custom vpn around it, I suppose. But AFAIK SOCKS isn't 100% transparent at the IP layer allowing all protocols to transparently layer on top? I guess SOCKS5 handles tcp and udp - so you might get away with redsocks (which explicitly recommends against using with TOR): https://github.com/darkk/redsocks https://github.com/darkk/redsocks See also transocks (SOCKS4 tcp only): https://transocks.sourceforge.net https://transocks.sourceforge.net And transocks (in go) https://github.com/cybozu-go/transocks https://github.com/cybozu-go/transocks Ed: see also https://news.ycombinator.com/item?id=30684574 https://news.ycombinator.com/item?id=30684574
- samhw 5y ago
  Does anyone know how TAILS accomplishes this, then? It doesn't rely on a relay like Whonix does, but I'm not a networking expert or a Linux expert, so I'm not altogether sure how it does work.
  - nopcode 5y ago
    TAILS has a very simple approach: - Configure all applications to use Tor with the SOCKS proxy - Block all non-Tor traffic with iptables https://tails.boum.org/contribute/design/Tor_enforcement https://tails.boum.org/contribute/design/Tor_enforcement
    - samhw 5y ago
      Ah, interesting, thank you. As far as point (b) goes, it seems to work pretty well: I can’t recall an occasion where I’ve had traffic blocked. (I suppose in practice not many applications use custom IP-but-not-TCP-or-UDP-based protocols.) So could that same thing not be a solution to e12e’s question?
- conradev 5y ago
  Tor itself does not support UDP, even if SOCKS might
onedognight 5y ago
One way is to enable a global `LD_PRELOAD=libtsocks.so` (transparent socks) environment variable where you provide an optionally suid (to allow suid binaries to use it if you want) library that overrides `connect`, etc. and forwards them to your socks proxy. Make sure you get ipv4 and ipv6 support if you care. This is not bullet proof by any means. Any application that doesn't using the C library (e.g. go) will not proxy, but most things will.
- paskozdilar 5y ago
  There is a shell wrapper `tsocks` that does all that - all you need is to configure the SOCKS server/port in /etc/tsocks.conf and run `tsocks $COMMAND`, and all the TCP connections of `$COMMAND` will be tunneled through the SOCKS proxy. Combined with ssh's `-D` option, it becomes a powerful ad-hoc VPN tool.
  - hkt 5y ago
    TIL about stocks - thank you!
beardog 5y ago
You have to be careful proxying everything through Tor if you care about using Tor to its full effectiveness, widely known issues with exit nodes aside, applications may naively sent through the same circuit: https://www.whonix.org/wiki/Stream_Isolation https://www.whonix.org/wiki/Stream_Isolation
nopcode 5y ago
Best option is to use software that supports SOCKS. Alternatively you can set up local proxies (eg stunnel) or inject SOCKS support into the TCP calls of your app (eg. ProxyChains) Tor only supports TCP, so you cannot route all traffic over Tor, you will have to drop a bunch.
nofunsir 5y ago
<NOTIFICATION: Incoming chat from random IT person> Hey so I’ve been meaning to ask you about all this ssh traffic coming from your box. Do you know what that could be?
throwaway5486nv 5y ago
Theoretically with systemd there is a way to create a container to do this. But its too complex, i could not get it to work.

koblas 5y ago

Isn't that just NAT through a SOCKS proxy as transport. Never would have imaged that use case.

qersist3nce 5y ago
>Never would have imaged that use case. circumventing censorship and geo-restrictions?
- koblas 5y ago
  Let me clarify -- I never would have imagined SOCKS being used for this use case. There was no such thing as geo-restrictions or censorship at the time on the internet.

guerby 5y ago

The way it's done is described here: https://unix.stackexchange.com/questions/166692/how-does-a-transparent-socks-proxy-know-which-destination-ip-to-use https://unix.stackexchange.com/questions/166692/how-does-a-t... A part from tor I don't know if there's a generic tool packaging this.

guerby 5y ago
Found one here: https://hev.cc/3033.html https://hev.cc/3033.html https://github.com/heiher/hev-socks5-tproxy https://github.com/heiher/hev-socks5-tproxy

e12e 5y ago

I don't think you can generally expect all processes to transparently use a SOCKS proxy? You might be able to finagle a custom vpn around it, I suppose. But AFAIK SOCKS isn't 100% transparent at the IP layer allowing all protocols to transparently layer on top? I guess SOCKS5 handles tcp and udp - so you might get away with redsocks (which explicitly recommends against using with TOR): https://github.com/darkk/redsocks https://github.com/darkk/redsocks See also transocks (SOCKS4 tcp only): https://transocks.sourceforge.net https://transocks.sourceforge.net And transocks (in go) https://github.com/cybozu-go/transocks https://github.com/cybozu-go/transocks Ed: see also https://news.ycombinator.com/item?id=30684574 https://news.ycombinator.com/item?id=30684574

samhw 5y ago
Does anyone know how TAILS accomplishes this, then? It doesn't rely on a relay like Whonix does, but I'm not a networking expert or a Linux expert, so I'm not altogether sure how it does work.
- nopcode 5y ago
  TAILS has a very simple approach: - Configure all applications to use Tor with the SOCKS proxy - Block all non-Tor traffic with iptables https://tails.boum.org/contribute/design/Tor_enforcement https://tails.boum.org/contribute/design/Tor_enforcement
  - samhw 5y ago
    Ah, interesting, thank you. As far as point (b) goes, it seems to work pretty well: I can’t recall an occasion where I’ve had traffic blocked. (I suppose in practice not many applications use custom IP-but-not-TCP-or-UDP-based protocols.) So could that same thing not be a solution to e12e’s question?
conradev 5y ago
Tor itself does not support UDP, even if SOCKS might

onedognight 5y ago

One way is to enable a global `LD_PRELOAD=libtsocks.so` (transparent socks) environment variable where you provide an optionally suid (to allow suid binaries to use it if you want) library that overrides `connect`, etc. and forwards them to your socks proxy. Make sure you get ipv4 and ipv6 support if you care. This is not bullet proof by any means. Any application that doesn't using the C library (e.g. go) will not proxy, but most things will.

paskozdilar 5y ago
There is a shell wrapper `tsocks` that does all that - all you need is to configure the SOCKS server/port in /etc/tsocks.conf and run `tsocks $COMMAND`, and all the TCP connections of `$COMMAND` will be tunneled through the SOCKS proxy. Combined with ssh's `-D` option, it becomes a powerful ad-hoc VPN tool.
- hkt 5y ago
  TIL about stocks - thank you!

beardog 5y ago

You have to be careful proxying everything through Tor if you care about using Tor to its full effectiveness, widely known issues with exit nodes aside, applications may naively sent through the same circuit: https://www.whonix.org/wiki/Stream_Isolation https://www.whonix.org/wiki/Stream_Isolation

nopcode 5y ago

Best option is to use software that supports SOCKS. Alternatively you can set up local proxies (eg stunnel) or inject SOCKS support into the TCP calls of your app (eg. ProxyChains) Tor only supports TCP, so you cannot route all traffic over Tor, you will have to drop a bunch.

nofunsir 5y ago

<NOTIFICATION: Incoming chat from random IT person> Hey so I’ve been meaning to ask you about all this ssh traffic coming from your box. Do you know what that could be?

throwaway5486nv 5y ago

Theoretically with systemd there is a way to create a container to do this. But its too complex, i could not get it to work.