Hacker News Reader

Comment by SageRaven | Hacker News Reader

I've got 3 low quality VPSs, priced from $0.99 to $2.50 per month, that I picked up on a whim over the years from deals posted to http://www.lowendbox.com (no affiliation). On one server, I have squid running and bound to localhost. On my machine, I have autossh set up to maintain a constant port-forwarding connection established (via port 443 for maximum firewall/filter accessibility) with the squid server. I have my local web browsers proxying over that connection.

So I'm pretty safe from snooping by my employer, home ISP, or whatever 133t hackers are sniffing traffic at McDonald's when I'm browsing and sipping a coffee.

It's not the most elegant solution, but it does the trick. I supposed some day I'll mess around with OpenVPN (which I have deployed before, and do really like), but only when I'm bored or otherwise have nothing else better to do with my time.

View on HN

Just fyi, all your non-HTTP Flash traffic (Flash sockets) is probably not being proxied at all. Even if you have a SOCKS proxy set in the browser.

The easiest way around this is VPN, but you can also do crazier stuff like use ProxyCap (for windows or OSX) or iptables redirect/transocks setup in Linux: http://coderrr.wordpress.com/2009/07/29/how-to-force-flash-o...

Linux has tsocks and proxychains which override the connect() method with a LD_PRELOAD library and force traffic to go through a socks proxy. Easier than iptables since at least proxychains can be installed with apt-get on Ubuntu(don't know about other OSes).

Only problem with the LD_PRELOAD method is that it doesn't work for all (many) apps. I believe one case it breaks for is non blocking connect()s, not sure if there are others. Although the iptables setup is a lot more complicated it pretty much works for everything.

An example I have found is rtorrent. There is also https://github.com/apenwarr/sshuttle, which looks promising, but I haven't used it. My vps provider doesn't provide tap for openvpn to work.

this is a fine solution, and what i've used before.

it's worth pointing out that you only gain privacy for browsers and apps that _choose_ to use IE's proxy settings. your native IM client, even if it is using HTTP, may or may not use the proxy. Your remote desktop client probably isn't using HTTP so it can't use the proxy.

with VPN you just don't care, all network traffic is routed through the VPN at network-driver level.

One interesting benefit of using a local proxy tunnel (instead of VPN) is that you get rid of one round trip when making TCP connections. Since your browser will connect to localhost (~0ms) it will be able to send the HTTP request immediately rather than having to wait for a connection to be established to a remote host. Whether this actually ends up being faster or not depends on the distance between you and your proxy server and your proxy server and the remote host you're connecting to.

I have the same, but then use sshuttle [1] for a quick secure connection. Only does TCP, but if that doesn't bother you you can get it set up in 2 minutes.

[1] https://github.com/apenwarr/sshuttle [2] For Lion: https://github.com/thatha/sshuttle/blob/macos_10_7_only_hack...

Just a quick note. Make sure your VPS is Xen/KVM/Vmware and not OpenVZ or some other container based virtualization if you want to use OpenVPN since it needs access to tun/tap devices. On OpenVZ based virtual machines, the administrator has to specifically grant you that access, which might not be possible on a $1/month machine.

I recently bought the same for $15/year.

Care to share your squid.conf? I just want a non-caching anonymous forwarding proxy and am finding the huge amount of options a bit of a muddle to work through. Seeing yours would be a help, if you are ok with that.

I think the only magic lines deviating from the defaults are:

    no_cache deny all
    forwarded_for off
    via off

The first disables caching, and the last two are for a little extra privacy. You can verify if you're caching by checking your cache spool for files:

    find /var/spool/squid/ -type f

IM clients, anything that sends UDP, DNS requests are all possibly and probably leaking out.

At least on OSX, that isn't the case. Even the DNS requests are being proxied through the tunnel.

Where are you setting the proxy at, and what method of proxying are you using?

Reply on news.ycombinator.com