5 ms·

If anyone's ever looking for an even quicker hack, ssh has built-in the ability to act as a SOCKS5 proxy, tunneling your traffic over ssh to whatever remote mac

by cfallin 12y ago

If anyone's ever looking for an even quicker hack, ssh has built-in the ability to act as a SOCKS5 proxy, tunneling your traffic over ssh to whatever remote machine you might have access to: $ ssh -D 1080 myserver.myhost.net Then configure Chrome or Firefox or whatever to use a SOCKS5 proxy on localhost, port 1080. (N.B. that this does not tunnel DNS lookups by default.) The OpenVPN-based route is the way to go for something used regularly, but the above is sometimes super-convenient!

joshbaptiste 12y ago
Yep.. with both browsers I install Foxy-proxy which makes switching proxies super easy.
christop 12y ago
Even quicker still is to use sshuttle; it automatically transparently tunnels all of your traffic through an SSH connection, without having to change any proxy settings. Very useful.
bitserf 12y ago
You can get the OpenVPN route quite seamless from a client perspective (server is still a pain in the ass to set up). You can bundle all the configuration for a particular client into a .ovpn file - this includes the client and CA certificates. I use this on iPhones and iPads, with the OpenVPN iOS app - works great for a family of iOS devices that need access to some geo-locked services.
- subliminalpanda 12y ago
  Agreed, I set myself up an OpenVPN server on digitalocean without too much of a hassle. The easy-rsa utilities make the whole process quite simple. It has frankly been a life saver for me, as it allows me to bypass all restrictions imposed where I live (Oman).
delsarto 12y ago
I think the fact that this leaks DNS lookups is really quite key because that gives away a huge amount about what you're looking at over your "vpn", not to mention services like netflix that are pointing you to different responses based upon the source of your dns lookups. In firefox you want to go to about:config page and turn on network.proxy.socks_remote_dns
- rufugee 12y ago
  Nice! I've been using dnsmasq to route my DNS queries and prevent leakage. Didn't realize the nework.proxy.socks_remote_dns option existed. Thanks for sharing!
- ReidZB 12y ago
  I'm using the latest stable release of Firefox (34.0.5) and I see a "Remote DNS" checkbox under my SOCKS proxy configuration. Isn't that the same option in the GUI? No about:config tweaks needed? I would think so, but everyone seems to be giving the about:config business, so maybe I am missing something.
  - delsarto 12y ago
    Most probably it has been added, my notes from this are from 2008 so it's hardly cutting edge! :)
  - mortenlarsen 12y ago
    Yes, that is the same option. Toggling the option in the GUI toggles network.proxy.socks_remote_dns in about:config. As default it is, is still off though.
- Juha 12y ago
  I have been using Chrome/FF extension called FoxyProxy, it tunnels the DNS requests through the SOCKS proxy.
- chrissnell 12y ago
  I believe that Mac OS X does tunnel DNS when you configure the proxy through Control Panel -> Network. I used this when I was in the Army and lived in housing whose internet connections were managed by a crappy ISP that did DNS-based filtering of sites they deemed objectionable.
deleted 12y ago
[deleted]
icehawk 12y ago
Firefox has the config option network.proxy.socks_remote_dns which you can toggle to prevent DNS leakage.
rdtsc 12y ago
Even better trick is SSH can actually tunnel level 3 data! Via TUN/TAP interfaces (this is effectively how some VPN implementations do it). See "-w" option Here are a few guides. This is more involved than just adding the -D option and setting a "proxy" field in some applications but this is more general as well: http://sleepyhead.de/howto/?href=vpn http://sleepyhead.de/howto/?href=vpn https://wiki.archlinux.org/index.php/VPN_over_SSH https://wiki.archlinux.org/index.php/VPN_over_SSH https://help.ubuntu.com/community/SSH_VPN https://help.ubuntu.com/community/SSH_VPN
- cperciva 12y ago
  Yes, except for the TCP-over-TCP issue.
  - rdtsc 12y ago
    Great point, Colin. That probably explains why it is not more popular (or it is rather a new-ish feature...). I was just surprised it was there.
  - illumen 12y ago
    SSH does it's own flow control, and with HPN-SSH it is much better. Also, if your connection to the VPN host is quite good, then the TCP-over-TCP issue does not apply as much. The bad cases happen when that connection has packet loss.
    - gonzo 12y ago
      All connections have packet loss.
pbhjpbhj 12y ago
I sometimes use sshuttle when I want to tunnel traffic through a remote server, can intercept and route DNS requests along the tunnel to using --dns. sshuttle --dns -r root@XX.XX.XX.XX 0/0 --exclude 192.168.0.0/9 Exclude as used here stops local addresses being tunneled.
- pi-rat 12y ago
  Love sshuttle, sadly it stopped working on OS X some time ago when apple moved from ipfw to pf. I hope someone is able to crank out a version that used pf soon.
ewang1 12y ago
Would setting it as a proxy under the network connection (i.e. Network > Advanced in OS X) force all traffic (including DNS) over the proxy?
- jradd 12y ago
  You could configure a transparent proxy with Privoxy set to use a custom dns server with dnsmasq and foxy-proxy to configure firefox to use that to forward dns request through your proxy.
ForestC 12y ago
Ah yes, ssh tunneling. The high school IT initiate's go-to method to dodge the web filter. It really can be an elegant solution when you don't have the patience to rev up OpenVPN for real.

by cfallin 12y ago

joshbaptiste 12y ago

Yep.. with both browsers I install Foxy-proxy which makes switching proxies super easy.

christop 12y ago

Even quicker still is to use sshuttle; it automatically transparently tunnels all of your traffic through an SSH connection, without having to change any proxy settings. Very useful.

bitserf 12y ago

You can get the OpenVPN route quite seamless from a client perspective (server is still a pain in the ass to set up). You can bundle all the configuration for a particular client into a .ovpn file - this includes the client and CA certificates. I use this on iPhones and iPads, with the OpenVPN iOS app - works great for a family of iOS devices that need access to some geo-locked services.

subliminalpanda 12y ago
Agreed, I set myself up an OpenVPN server on digitalocean without too much of a hassle. The easy-rsa utilities make the whole process quite simple. It has frankly been a life saver for me, as it allows me to bypass all restrictions imposed where I live (Oman).

delsarto 12y ago

I think the fact that this leaks DNS lookups is really quite key because that gives away a huge amount about what you're looking at over your "vpn", not to mention services like netflix that are pointing you to different responses based upon the source of your dns lookups. In firefox you want to go to about:config page and turn on network.proxy.socks_remote_dns

rufugee 12y ago
Nice! I've been using dnsmasq to route my DNS queries and prevent leakage. Didn't realize the nework.proxy.socks_remote_dns option existed. Thanks for sharing!
ReidZB 12y ago
I'm using the latest stable release of Firefox (34.0.5) and I see a "Remote DNS" checkbox under my SOCKS proxy configuration. Isn't that the same option in the GUI? No about:config tweaks needed? I would think so, but everyone seems to be giving the about:config business, so maybe I am missing something.
- delsarto 12y ago
  Most probably it has been added, my notes from this are from 2008 so it's hardly cutting edge! :)
- mortenlarsen 12y ago
  Yes, that is the same option. Toggling the option in the GUI toggles network.proxy.socks_remote_dns in about:config. As default it is, is still off though.
Juha 12y ago
I have been using Chrome/FF extension called FoxyProxy, it tunnels the DNS requests through the SOCKS proxy.
chrissnell 12y ago
I believe that Mac OS X does tunnel DNS when you configure the proxy through Control Panel -> Network. I used this when I was in the Army and lived in housing whose internet connections were managed by a crappy ISP that did DNS-based filtering of sites they deemed objectionable.

deleted 12y ago

[deleted]

icehawk 12y ago

Firefox has the config option network.proxy.socks_remote_dns which you can toggle to prevent DNS leakage.

rdtsc 12y ago

Even better trick is SSH can actually tunnel level 3 data! Via TUN/TAP interfaces (this is effectively how some VPN implementations do it). See "-w" option Here are a few guides. This is more involved than just adding the -D option and setting a "proxy" field in some applications but this is more general as well: http://sleepyhead.de/howto/?href=vpn http://sleepyhead.de/howto/?href=vpn https://wiki.archlinux.org/index.php/VPN_over_SSH https://wiki.archlinux.org/index.php/VPN_over_SSH https://help.ubuntu.com/community/SSH_VPN https://help.ubuntu.com/community/SSH_VPN

cperciva 12y ago
Yes, except for the TCP-over-TCP issue.
- rdtsc 12y ago
  Great point, Colin. That probably explains why it is not more popular (or it is rather a new-ish feature...). I was just surprised it was there.
- illumen 12y ago
  SSH does it's own flow control, and with HPN-SSH it is much better. Also, if your connection to the VPN host is quite good, then the TCP-over-TCP issue does not apply as much. The bad cases happen when that connection has packet loss.
  - gonzo 12y ago
    All connections have packet loss.

pbhjpbhj 12y ago

I sometimes use sshuttle when I want to tunnel traffic through a remote server, can intercept and route DNS requests along the tunnel to using --dns. sshuttle --dns -r root@XX.XX.XX.XX 0/0 --exclude 192.168.0.0/9 Exclude as used here stops local addresses being tunneled.

pi-rat 12y ago
Love sshuttle, sadly it stopped working on OS X some time ago when apple moved from ipfw to pf. I hope someone is able to crank out a version that used pf soon.

ewang1 12y ago

Would setting it as a proxy under the network connection (i.e. Network > Advanced in OS X) force all traffic (including DNS) over the proxy?

jradd 12y ago
You could configure a transparent proxy with Privoxy set to use a custom dns server with dnsmasq and foxy-proxy to configure firefox to use that to forward dns request through your proxy.

ForestC 12y ago

Ah yes, ssh tunneling. The high school IT initiate's go-to method to dodge the web filter. It really can be an elegant solution when you don't have the patience to rev up OpenVPN for real.