Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm renting a dedicated server which I'd like to use to "surf the Web": basically I want to always surf the Web from the same static IP (the one of my dedicated server).

I can do it by running Xvnc/FreeNX on the dedicated server, but this is kinda slow and clumsy (I tried it).

What are the steps needed to install an "elite/high-anonimity" Web proxy on a dedicated (Debian) Linux server knowing that my two requirements are:

  1. I'm the only person that needs access to the proxy
  2. all I want is that my broadband (dynamic) IP is completely hidden (I want to always surf from my dedicated server's IP).

Note that using the static IP people can find my domains and my real name and I'm perfectly fine with that (actually it is what I want). What I don't want is people knowing from which dynamic IP (broadband) I'm connecting.

What are the steps needed to do that?

(basically I don't care about "anonimity", what I want is to appear to surf from a static IP and I think I need what is called an "elite" Web proxy to do that, but I'm not sure)

Technical infos and sample configuration most welcome :)

share|improve this question
    
btw I'm not even sure: is Squid the way to go to do what I want? (if so, how should it be configured?) –  YellowSquirrel Apr 4 '10 at 2:06
add comment

4 Answers

One option for you is to set up a VPN server such as OpenVPN on your server, then add the appropriate configuration options to redirect all of your traffic via the VPN tunnel when it is enabled. This method is probably the most difficult but offers you the added advantage of having a means to encrypt your traffic by redirecting it over the tunnel if you are surfing from a public wifi hotspot. Another option is to set up a dedicated HTTP proxy such as Squid, which supports authentication to prevent unauthorized users from accessing the server. Probably the simplest option however is to use SSH to set up a socks proxy tunnel. If you are using OS X or Linux as your client, you can easily run a command such as "ssh -N -f -D 8080 user@your.server". This command causes SSH to fork into the background and create a tunnel on port 8080 which you can configure as a SOCKS proxy in your browser. You can also use this method on Windows via Cygwin if you install the openssh packages. As with the OpenVPN option, this method will encrypt the traffic between you and the server making it suitable for connecting from an untrusted location.

share|improve this answer
    
@Ron: ah damn I can't vote you up because I'm new here :) I do want to use a proxy such as Squid, I don't want to set up a VPN (locations are trusted) (btw it's all Linux/Firefox/Iceweasel, no Windows at all). I'm interested in the socks proxy tunnel: what you mean basically if I understand you right is that I could set up Squid that would only accept local (127.0.0.1) connection and then a SSH tunnel so that I'm the only one that could access it? (I've got a SSH tunnel as of now through which I'm tunneling Xvnc, but this is too slow). –  YellowSquirrel Apr 4 '10 at 5:39
    
@Ron: if Squid listen on port 3128, can't I do something like: ssh -T -N -x -C -L3128:127.0.0.1:3128 user@myserver.com ? Wouldn't that also work (I've never used the -D -f args). –  YellowSquirrel Apr 4 '10 at 5:54
add comment

2 options that are easy:

  1. Install squid -- there is probably a package for it. Then configure your web browsers proxy settings to point the the squid server. By default its probably going to be on port 3128.

  2. Install a socks proxy. Then in your proxy setting put the socks server address and port. The nice thing about socks is that it will proxy more than just web traffic. (e,g, Pidgin support SOCKS proxies)

share|improve this answer
    
@Craig: I ended up installing Squid. However by default it does not do what I want, because the originating IP appears quite clearly. I changed a few settings, set up a SSH tunnel, and got it working :) But I cannot give +1 to everybody because I don't have any +votes yet :( –  YellowSquirrel Apr 4 '10 at 7:19
add comment

I've never heard the term "elite proxy" and I don't think there is any special sort of tool you need to do what you want. If you already have a web server running on that dedicated server, you can probably set it up to provide the behavior you want. I've done this myself using Apache's mod_proxy. (You would want what Apache calls a "forward proxy")

I've never used Squid myself, but from what I've read about it I'm sure it could also do the job, and it might be more configurable since it's designed for the task of proxying HTTP requests... but it's certainly not the only thing you could use.

share|improve this answer
    
@David: apparently it's the accepted term for a Web proxy that hides the original IP. The term is used both on Wikipedia and on several articles on the subject, it gives quite some matches on Google too. Never heard of it before today neither ;) –  YellowSquirrel Apr 4 '10 at 5:34
add comment
up vote 0 down vote accepted

Answering to myself: I got it working quite easily...

I installed Squid on the dedicated server and modified a few things in squid.conf:

Mainly:

 forwarded_for off

And (the following being suggested in the squid.conf file):

header_access Allow allow all
header_access Authorization allow all
header_access WWW-Authenticate allow all
header_access Proxy-Authorization allow all
header_access Proxy-Authenticate allow all
header_access Cache-Control allow all
header_access Content-Encoding allow all
header_access Content-Length allow all
header_access Content-Type allow all
header_access Date allow all
header_access Expires allow all
header_access Host allow all
header_access If-Modified-Since allow all
header_access Last-Modified allow all
header_access Location allow all
header_access Pragma allow all
header_access Accept allow all
header_access Accept-Charset allow all
header_access Accept-Encoding allow all
header_access Accept-Language allow all
header_access Content-Language allow all
header_access Mime-Version allow all
header_access Retry-After allow all
header_access Title allow all
header_access Connection allow all
header_access Proxy-Connection allow all
header_access All deny all

Then I didn't think about simply using an SSH tunnel (Ron's answer pointed me in that direction), which is perfect in my case (because the firewalls where already configured to allow SSH from my ISP's IP range to my dedicated server etc.).

Then the client side:

ssh -T -N -x -C -L3128:127.0.0.1:3128 user@example.org

And simply setting up 127.0.0.1 3128 as the proxy in the browser.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.