Hacker News Reader

Comment by cfallin | Hacker News Reader

If anyone's ever looking for an even quicker hack, ssh has built-in the ability to act as a SOCKS5 proxy, tunneling your traffic over ssh to whatever remote machine you might have access to:

$ ssh -D 1080 myserver.myhost.net

Then configure Chrome or Firefox or whatever to use a SOCKS5 proxy on localhost, port 1080. (N.B. that this does not tunnel DNS lookups by default.)

The OpenVPN-based route is the way to go for something used regularly, but the above is sometimes super-convenient!

View on HN

I think the fact that this leaks DNS lookups is really quite key because that gives away a huge amount about what you're looking at over your "vpn", not to mention services like netflix that are pointing you to different responses based upon the source of your dns lookups.

In firefox you want to go to about:config page and turn on network.proxy.socks_remote_dns

I believe that Mac OS X does tunnel DNS when you configure the proxy through Control Panel -> Network. I used this when I was in the Army and lived in housing whose internet connections were managed by a crappy ISP that did DNS-based filtering of sites they deemed objectionable.

I'm using the latest stable release of Firefox (34.0.5) and I see a "Remote DNS" checkbox under my SOCKS proxy configuration. Isn't that the same option in the GUI? No about:config tweaks needed?

I would think so, but everyone seems to be giving the about:config business, so maybe I am missing something.

Yes, that is the same option. Toggling the option in the GUI toggles network.proxy.socks_remote_dns in about:config. As default it is, is still off though.

Most probably it has been added, my notes from this are from 2008 so it's hardly cutting edge! :)

Beware: https://news.ycombinator.com/item?id=8757877

I have been using Chrome/FF extension called FoxyProxy, it tunnels the DNS requests through the SOCKS proxy.

Nice! I've been using dnsmasq to route my DNS queries and prevent leakage. Didn't realize the nework.proxy.socks_remote_dns option existed. Thanks for sharing!

Even better trick is SSH can actually tunnel level 3 data! Via TUN/TAP interfaces (this is effectively how some VPN implementations do it).

See "-w" option

Here are a few guides. This is more involved than just adding the -D option and setting a "proxy" field in some applications but this is more general as well:

http://sleepyhead.de/howto/?href=vpn

https://wiki.archlinux.org/index.php/VPN_over_SSH

https://help.ubuntu.com/community/SSH_VPN

Yes, except for the TCP-over-TCP issue.

Great point, Colin. That probably explains why it is not more popular (or it is rather a new-ish feature...).

I was just surprised it was there.

SSH does it's own flow control, and with HPN-SSH it is much better.

Also, if your connection to the VPN host is quite good, then the TCP-over-TCP issue does not apply as much. The bad cases happen when that connection has packet loss.

All connections have packet loss.

I sometimes use sshuttle when I want to tunnel traffic through a remote server, can intercept and route DNS requests along the tunnel to using --dns.

    sshuttle --dns -r root@XX.XX.XX.XX 0/0 --exclude 192.168.0.0/9

Exclude as used here stops local addresses being tunneled.

Love sshuttle, sadly it stopped working on OS X some time ago when apple moved from ipfw to pf.

I hope someone is able to crank out a version that used pf soon.

Even quicker still is to use sshuttle; it automatically transparently tunnels all of your traffic through an SSH connection, without having to change any proxy settings.

Very useful.

You can get the OpenVPN route quite seamless from a client perspective (server is still a pain in the ass to set up).

You can bundle all the configuration for a particular client into a .ovpn file - this includes the client and CA certificates.

I use this on iPhones and iPads, with the OpenVPN iOS app - works great for a family of iOS devices that need access to some geo-locked services.

Agreed, I set myself up an OpenVPN server on digitalocean without too much of a hassle. The easy-rsa utilities make the whole process quite simple. It has frankly been a life saver for me, as it allows me to bypass all restrictions imposed where I live (Oman).

Ah yes, ssh tunneling. The high school IT initiate's go-to method to dodge the web filter. It really can be an elegant solution when you don't have the patience to rev up OpenVPN for real.

Firefox has the config option

  network.proxy.socks_remote_dns

which you can toggle to prevent DNS leakage.

Yep.. with both browsers I install Foxy-proxy which makes switching proxies super easy.

Would setting it as a proxy under the network connection (i.e. Network > Advanced in OS X) force all traffic (including DNS) over the proxy?

You could configure a transparent proxy with Privoxy set to use a custom dns server with dnsmasq and foxy-proxy to configure firefox to use that to forward dns request through your proxy.

Reply on news.ycombinator.com