5 ms·

Show HN: SMTP Tunnel – A SOCKS5 proxy disguised as email traffic to bypass DPI

140 points by lobito25 9mo ago

A fast SOCKS5 proxy that tunnels your traffic through what looks like normal SMTP email, bypassing Deep Packet Inspection firewalls. How it works: - Client runs a local SOCKS5 proxy (127.0.0.1:1080) - Traffic is sent to server disguised as SMTP (EHLO, STARTTLS, AUTH) - DPI sees legitimate email session, not a VPN/proxy Features: - One-liner install on any Linux VPS - Multi-user with per-user secrets and IP whitelists - Auto-generated client packages (just double-click to run) - Auto-reconnect on connection loss - Works with any app that supports SOCKS5 Tech: Python/asyncio, TLS 1.2+, HMAC-SHA256 auth GitHub: https://github.com/x011/smtp-tunnel-proxy https://github.com/x011/smtp-tunnel-proxy

thedougd 9mo ago
Quite a few things use STARTTLS. I imagine the same technique could be applied to those other protocols, giving users some options as they fight hostile networks. Clever
- montyanne 9mo ago
  Just curious - how much of this was AI generated? The readme has crazy emojis & the code was all checked in at once, which is usually my telltale for these kinds of things. Didn't see anything crazy in the source files. I think its polite to indicate AI agent usage in security related projects like this since they can have huge holes if they're just being vibe coded. -- Edit: Intended to post this on the board root, sorry.
  - zamadatix 9mo ago
    It's a fair question but I had a bit of a chuckle at the idea having a shit ton of emojis in your GitHub readme was the first flag it might be AI. Mostly because I always assumed the opposite - that GitHub readmes were a big part of the emoji ridden listicle training data (the other being slop "news" site/social media listicles) for AIs in the first place. After all, they are decently well written and come with grabbing the code to train from anyways.
    - userbinator 9mo ago
      Before the rise of AI, I had not seen much GitHub content with emojis at all, much less overused; I suspect their source is actually the latter of what you noted. Either way, it's a negative signal.
  - jeroenhd 9mo ago
    High emoji use is something I've noticed a certain generation/subgroup of developers just default to. Keeps things informal/quirky. The AI had to steal that style from someone, after all. This repo is actually very low on the emoji side. Looking through the code itself, I can't tell if it's AI generated or not, but I wouldn't assume the use of emoji automatically mean AI wrote the text.
m132 9mo ago
That's an interesting protocol choice, especially given the purpose. SMTP is probably the most filtered protocol on residential networks, SMB being a runner-up.
- catlifeonmars 9mo ago
  What would you reach for out of curiosity? For me RTP+rateless erasure codes come to mind, but I’m feeling Rube Goldbergy today.
  - sebazzz 9mo ago
    I think HTTP web sockets would be an interesting tunneling protocol.
    - bauruine 9mo ago
      Tor has a transport using exactly that. https://blog.torproject.org/introducing-webtunnel-evading-censorship-by-hiding-in-plain-sight/ https://blog.torproject.org/introducing-webtunnel-evading-ce...
    - megous 9mo ago
      You don't need websockets, just Connection: Upgrade to anything you want. You can upgrade directly to ssh protocol and just pass on decrypted data from https socket to local port 22 from then on with no further processing.
      - ranger_danger 9mo ago
        Proper DPI can tell that wouldn't be acting like a typical HTTP stream, encrypted or not.
        catlifeonmars 9mo ago
        Hehe true, SSH traffic is so characteristically obvious that the packet size and timing can be used as a side channel to leak information about a session. Tangential: but I recall reading about a similar technique used on SRTP packets to guess the phonemes being uttered without needing to decrypt the traffic.
Gathering6678 9mo ago
I suppose it would be trivial to simply block or severely throttle high-volume SMTP traffic?
- userbinator 9mo ago
  Additionally, this will make it look like you're a spammer.
- stackskipton 9mo ago
  You could block SMTP on almost all end user networks with no one noticing. 99.9+% of email client submission is HTTPS.
  - ranger_danger 9mo ago
    Source:
  - bauruine 9mo ago
    I doubt it's that much but with the same logic you could also ban HN, SSH and basically any protocol thats not https "with no one noticing" because 99.9+% doesnt use it.
neilv 9mo ago
How does this get past firewalls that would block the alternative, of SOCKS5 traffic tunneled through port-443 HTTPS with keepalives? (Even with complete HTTPS decryption in the firewall, the downstream traffic could look like, say, random CSV data file downloads or innocuous HTML text, and upstream traffic could look like innocuous requests (avoiding large lists of problematic keywords).)
YouAreWRONGtoo 9mo ago
[dead]
usAyayo 9mo ago
[dead]
bmenrigh 9mo ago
Large volumes of SMTP-like traffic are a huge red flag. Competent companies an ISPs should already be looking for large volumes of outbound mail to identify abuse / spam bots / data exfiltration. If I came across this in netflow data I'd first assume outbound spam. But a hallmark of sending mail is that the client to server byte ratio is extremely skewed towards client -> server bytes, whereas running a VPN-like service is usually more balanced but still skewed towards server -> client bytes. I'd see the large server -> client byte count and immediately know something strange was going on. That said, very little code here is involved in looking like SMTP. The SMTP obfuscation basically boils down to a few lines of plaintext between the client and server before a STARTTLS and then everything after that has nothing to do with SMTP. You could swap out the fake stub conversation quite easily to look like many other protocols. Whether the in to out bytes ratio makes sense for those protocols is another matter. These days, I think the best thing to disguise as is HTTPS. There is so much variety in HTTPS traffic and such a huge volume of it, that spotting hidden tunnels is very hard.
- compsciphd 9mo ago
  a former company I was at, didn't allow outbound ssh (which I liked to enable me to vnc into boxes at home). I installed installed a webvnc application on my home machine (protected by https / password) and was able to access it without an issue. When I left the company they went through my outbound email and were like "why did you forward an email you got out of the company". That e-mail was a friend visiting and me getting sent their picture from the lobby telling me that I had a visitor (so figured it be cute to share the image with them). I was amused that they only bothered to ask me as I was leaving, not when it actually occurred.
  - janwillemb 9mo ago
    I used to host an SSH server at home at port 443, for the same reason! The sysadmin of my employer was so strict that 'solutions' like this were the way of the least resistance. Security gets worse when policies get stricter.
- geocar 9mo ago
Haaargio 9mo ago
Get yourself an IP with Port 443 free and just use that. SMTP is blocked by a lot of firewalls by default. All cloud providers do that and you need to request opening them up.
deleted 9mo ago
[deleted]
ralferoo 9mo ago
This seems daft to me as it would be trivial to identify on a network. Real SMTP will have significant data flow in one direction towards the destination, will close the connection fairly quickly once it's transferred (so no pauses) and has very little traffic being returned. It's hard to think of a worst protocol to try to hide a proxy in.
mycall 9mo ago
It would be great if it also worked as SMTP server
ok123456 9mo ago
Back in the 90s, I ran telnet on the POP3 port so I could IRC in the lab during high school. The more things change, the more they stay the same.
dfajgljsldkjag 9mo ago
So many comments explaining this is a bad idea while OP just asked claude code to write this and probably doesn't even know the difference between TCP and IP.
lobito25 9mo ago
Here's a similar project that uses IMAP instead of SMTP: https://github.com/x011/imap-tunnel-proxy https://github.com/x011/imap-tunnel-proxy
devrimer 9mo ago
finally we can use that in Turkmenistan :D
kotri 9mo ago
There is QTGate (IMAP tunnel) years ago. https://github.com/Kisesy/gscan_quic/issues/47 https://github.com/Kisesy/gscan_quic/issues/47

140 points by lobito25 9mo ago

thedougd 9mo ago

Quite a few things use STARTTLS. I imagine the same technique could be applied to those other protocols, giving users some options as they fight hostile networks. Clever

montyanne 9mo ago
Just curious - how much of this was AI generated? The readme has crazy emojis & the code was all checked in at once, which is usually my telltale for these kinds of things. Didn't see anything crazy in the source files. I think its polite to indicate AI agent usage in security related projects like this since they can have huge holes if they're just being vibe coded. -- Edit: Intended to post this on the board root, sorry.
- zamadatix 9mo ago
  It's a fair question but I had a bit of a chuckle at the idea having a shit ton of emojis in your GitHub readme was the first flag it might be AI. Mostly because I always assumed the opposite - that GitHub readmes were a big part of the emoji ridden listicle training data (the other being slop "news" site/social media listicles) for AIs in the first place. After all, they are decently well written and come with grabbing the code to train from anyways.
  - userbinator 9mo ago
    Before the rise of AI, I had not seen much GitHub content with emojis at all, much less overused; I suspect their source is actually the latter of what you noted. Either way, it's a negative signal.
- jeroenhd 9mo ago
  High emoji use is something I've noticed a certain generation/subgroup of developers just default to. Keeps things informal/quirky. The AI had to steal that style from someone, after all. This repo is actually very low on the emoji side. Looking through the code itself, I can't tell if it's AI generated or not, but I wouldn't assume the use of emoji automatically mean AI wrote the text.

m132 9mo ago

That's an interesting protocol choice, especially given the purpose. SMTP is probably the most filtered protocol on residential networks, SMB being a runner-up.

catlifeonmars 9mo ago
What would you reach for out of curiosity? For me RTP+rateless erasure codes come to mind, but I’m feeling Rube Goldbergy today.
- sebazzz 9mo ago
  I think HTTP web sockets would be an interesting tunneling protocol.
  - bauruine 9mo ago
    Tor has a transport using exactly that. https://blog.torproject.org/introducing-webtunnel-evading-censorship-by-hiding-in-plain-sight/ https://blog.torproject.org/introducing-webtunnel-evading-ce...
  - megous 9mo ago
    You don't need websockets, just Connection: Upgrade to anything you want. You can upgrade directly to ssh protocol and just pass on decrypted data from https socket to local port 22 from then on with no further processing.
    - ranger_danger 9mo ago
      Proper DPI can tell that wouldn't be acting like a typical HTTP stream, encrypted or not.
      - catlifeonmars 9mo ago
        Hehe true, SSH traffic is so characteristically obvious that the packet size and timing can be used as a side channel to leak information about a session. Tangential: but I recall reading about a similar technique used on SRTP packets to guess the phonemes being uttered without needing to decrypt the traffic.

Gathering6678 9mo ago

I suppose it would be trivial to simply block or severely throttle high-volume SMTP traffic?

userbinator 9mo ago
Additionally, this will make it look like you're a spammer.
stackskipton 9mo ago
You could block SMTP on almost all end user networks with no one noticing. 99.9+% of email client submission is HTTPS.
- ranger_danger 9mo ago
  Source:
- bauruine 9mo ago
  I doubt it's that much but with the same logic you could also ban HN, SSH and basically any protocol thats not https "with no one noticing" because 99.9+% doesnt use it.

neilv 9mo ago

How does this get past firewalls that would block the alternative, of SOCKS5 traffic tunneled through port-443 HTTPS with keepalives? (Even with complete HTTPS decryption in the firewall, the downstream traffic could look like, say, random CSV data file downloads or innocuous HTML text, and upstream traffic could look like innocuous requests (avoiding large lists of problematic keywords).)

YouAreWRONGtoo 9mo ago

[dead]

usAyayo 9mo ago

[dead]

bmenrigh 9mo ago

Large volumes of SMTP-like traffic are a huge red flag. Competent companies an ISPs should already be looking for large volumes of outbound mail to identify abuse / spam bots / data exfiltration. If I came across this in netflow data I'd first assume outbound spam. But a hallmark of sending mail is that the client to server byte ratio is extremely skewed towards client -> server bytes, whereas running a VPN-like service is usually more balanced but still skewed towards server -> client bytes. I'd see the large server -> client byte count and immediately know something strange was going on. That said, very little code here is involved in looking like SMTP. The SMTP obfuscation basically boils down to a few lines of plaintext between the client and server before a STARTTLS and then everything after that has nothing to do with SMTP. You could swap out the fake stub conversation quite easily to look like many other protocols. Whether the in to out bytes ratio makes sense for those protocols is another matter. These days, I think the best thing to disguise as is HTTPS. There is so much variety in HTTPS traffic and such a huge volume of it, that spotting hidden tunnels is very hard.

compsciphd 9mo ago
a former company I was at, didn't allow outbound ssh (which I liked to enable me to vnc into boxes at home). I installed installed a webvnc application on my home machine (protected by https / password) and was able to access it without an issue. When I left the company they went through my outbound email and were like "why did you forward an email you got out of the company". That e-mail was a friend visiting and me getting sent their picture from the lobby telling me that I had a visitor (so figured it be cute to share the image with them). I was amused that they only bothered to ask me as I was leaving, not when it actually occurred.
- janwillemb 9mo ago
  I used to host an SSH server at home at port 443, for the same reason! The sysadmin of my employer was so strict that 'solutions' like this were the way of the least resistance. Security gets worse when policies get stricter.
geocar 9mo ago

Haaargio 9mo ago

Get yourself an IP with Port 443 free and just use that. SMTP is blocked by a lot of firewalls by default. All cloud providers do that and you need to request opening them up.

deleted 9mo ago

[deleted]

ralferoo 9mo ago

This seems daft to me as it would be trivial to identify on a network. Real SMTP will have significant data flow in one direction towards the destination, will close the connection fairly quickly once it's transferred (so no pauses) and has very little traffic being returned. It's hard to think of a worst protocol to try to hide a proxy in.

mycall 9mo ago

It would be great if it also worked as SMTP server

ok123456 9mo ago

Back in the 90s, I ran telnet on the POP3 port so I could IRC in the lab during high school. The more things change, the more they stay the same.

dfajgljsldkjag 9mo ago

So many comments explaining this is a bad idea while OP just asked claude code to write this and probably doesn't even know the difference between TCP and IP.

lobito25 9mo ago

Here's a similar project that uses IMAP instead of SMTP: https://github.com/x011/imap-tunnel-proxy https://github.com/x011/imap-tunnel-proxy

devrimer 9mo ago

finally we can use that in Turkmenistan :D

kotri 9mo ago

There is QTGate (IMAP tunnel) years ago. https://github.com/Kisesy/gscan_quic/issues/47 https://github.com/Kisesy/gscan_quic/issues/47