10

is it any easy way to route all traffic through a ssh proxy with -D?

I can configure individual specific applications to do this, but I would like a configuration that routes all the traffic on the machine. Thanks for your help!

1
  • Forgot to say that I was on linux so idealy, something by which I can route using iptables.
    – grm
    Feb 23, 2010 at 8:13

5 Answers 5

11

In Linux:

  1. iptables -t nat -A OUTPUT ! -d 127.0.0.0/8 -j REDIRECT --to 1081
  2. Run program that listens 1081, retrieves actual, non-redirected destination address, negotiates with SOCKS server and relays.

I have written such program for private usage in Perl (prototype quality) and writing a better version in C. It is not yet published.

Update: now published: http://github.com/vi/socksredirect/ Use prototype.pl. Send me some notice if you interested in development of better version.

Update 2 Created a bit better version of it: http://github.com/vi/tcpsocks and a patch for Socat 2: http://github.com/vi/socksredirect/blob/master/socat-2.0.0-b3-REDIRECT.patch

P.S. Most of my (and sometimes some of neighbours') traffic now goes through the tcpsocks->ssh.

7
  • Very interesting project Vi. Thanks! I will give this a look.
    – grm
    Mar 15, 2010 at 11:19
  • You should probably use more iptables rules to select which traffic do you want to be socksified. I use "iptables -t nat -A OUTPUT -j QQQ", then bunch of "iptables -t nat -A QQQ <checks> -j RETURN" and finally "iptables -t nat -A QQQ -p tcp -j REDIRECT --to 1234".
    – Vi.
    Mar 15, 2010 at 11:53
  • Thank you! I've been wondering if this was doable, it was on my loong list of project ideas to try sometime.
    – Tobu
    Nov 19, 2010 at 21:39
  • @Tobu, I have implemented this more: now there is a Socat patch (github.com/vi/socksredirect/blob/master/…) for this and also light-weight tcpsocks program (github.com/vi/tcpsocks)
    – Vi.
    Nov 20, 2010 at 14:40
  • 1
    @Tanmay, With a tun device you will see just TCP packets and it would be tricky to decode them into a stream of bytes (you would need something like slirp). with REDIRECT or TPROXY just use usual recv which gives you decoded data without TCP headers.
    – Vi.
    Dec 28, 2016 at 21:05
8

Avery Pennarun's sshuttle works similar to Vi's answer, but requires less setup and works on BSD and OS X as well as Linux.

2

Maybe you should considering setting up VPN instead.

2
  • Wouldn't that require more access on the gateway side?
    – grm
    Feb 23, 2010 at 8:14
  • I got a VPN server (poptop) setup at home on Ubuntu. And at work I just use the builtin VPN client in windows to connect to it. No bother ing my network administrator or anything. Feb 23, 2010 at 8:53
1

I don't think there's any way to do this, but maybe you can try programs like FreeCap(windows), SocksCap(windows) or proxychains(linux). These programs may help you a little bit.

0

Depends which OS you are using. If you are on MacOS there are global Proxy settings which should be used by every Application, even though there are some who don't honor them (Firefox ie).

1
  • With MacOS in particular, trusting the global proxy settings needs to be verified.
    – chiggsy
    Nov 20, 2010 at 21:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .