I'd like traffic to be routed via a proxy or VPN based on a the client's hosts file (or DNS that is given to the client).

This doesn't seem like a problem for http traffic on port 80 as a simple squid proxy can do that however I don't know which protocols the client will be sending so I need to proxy all ports.

I have no control over the client apart from hosts/DNS.

Typical Proxy - Can only work for certain protocols/ports

SOCKS Proxy - Works for all but requires client config

VPN - Works for all but requires client config

How can I have a Proxy or VPN that listens on all ports and will act as a transparent endpoint for certain hosts?

Thank you very much in advance.

  • i think squid do it for you:tldp.org/HOWTO/TransparentProxy.html, but i prefer you to use OpenVPN, or poptop
    – pylover
    Jan 8 '13 at 1:32
  • @pylover - how do you propose using Squid to proxy anything other than HTTP and possibly FTP?
    – EEAA
    Jan 8 '13 at 1:37
  • you can use squid as a transparent proxy behind a VPN. see the link. i already tested it in my private ubuntu server.
    – pylover
    Jan 8 '13 at 1:40
  • @pylover - Sure for HTTP and FTP. Doesn't help you with anything else, though. Besides, the OP mentioned that VPN isn't a possibility.
    – EEAA
    Jan 8 '13 at 1:43

Well I think you've answered your own question. You're out of luck.

It is very odd to only have administrative access to DNS and host file configuration on your clients. What is your use case here? Typically in this situation, one would install a VPN client and a default route pointing through the tunnel.

  • The thing is, I know it's possible as there are a number of sites doing it which is what I'm trying to emulate such as Overplay and unblock-us. Obviously what they have is proprietary so they won't share but it's really bugging me that I can't work out how they do it!
    – Dogsbody
    Jan 16 '13 at 12:43
  • sshuttle pretty much does what I want but I don't think that's ready for production.
    – Dogsbody
    Jan 16 '13 at 12:47

This should be a comment, but its a bit long.

Short answer is that what you describe is impossible.

You seem to be abusing the term "VPN" to describe a anonymization service - a lot of anonymization services brand themselves as VPN to give themselves an air of legitimacy.

Whatever overplay and unblock-us are doing (I can think of several possible ways this might be implemented) does not meet the requirements of what you describe; they are clearly providing application layer proxying (and you specifically state that you require network layer proxying). That rather makes me think that you are not actually in a position to implement anything approaching your requirement. Add to that the fact that either you don't know how much effort would be involved in setting up something like this and think your approoach is cheaper than theirs, or you are seeking to achieve something not even the dodgiest of anonymization providers would turn a blind eye to.

So even of there were a solution to met your requirements, it would be somewhat irresponsible to share that here.

Not the answer you're looking for? Browse other questions tagged or ask your own question.