2 ms·
> Combining this with ssh -D and you can effectively VPN your Firefox traffic out any box you can ssh to, including the DNS requests. This has been both useful
by ignoramous 5y ago
> Combining this with ssh -D and you can effectively VPN your Firefox traffic out any box you can ssh to, including the DNS requests. This has been both useful for me as a troubleshooting tool and as a simple internet VPN.
You can essentially "VPN" (relay) your in-browser http traffic with just DoH.
Setup a DoH stub resolver to reply with the same ("gateway") IP for all DNS queries, then on the gateway IP, forward traffic by sniffing TLS SNI (http2/http1.1) or snooping the host headers (http1).
This won't / can't work with http3 because defence against ossification (by such middlewares) was one of quic's design goals (http3's underlying transport). You can blackhole all UDP traffic on the gateway though, which should block http3 altogether.
The only real worry is there's no authentication at the gateway. Could impl it with some form of "captive portal", however.
A toy go program I co-authored can act like the aforementioned "gateway": https://github.com/celzero/midway https://github.com/celzero/midway
- zamadatix 5y agoThat's really fun and clever :), I love hacking with network protocols like that. Go or JS(Node/Deno) is also how I usually go about it! Is there any place I can follow you at outside of GitHub?
- ignoramous 5y agoThanks :) I'm not as active on other social media. I must also point out that my networking chops are at beginner level. midway is mostly adopted from inetaf/tcpproxy and dlundquist/sniproxy. > Go or JS(Node/Deno) is also how I usually go about it! Pretty much my choice of languages too. Deno, especially, is a wonderful alternative to Go. I co-maintain a DoH stub-resolver that runs on Node/Deno: https://github.com/serverless-dns/serverless-dns https://github.com/serverless-dns/serverless-dns