I know the answer is bit late, but for the reference and for those who are still looking for the answer,
Set the network.proxy.socks_remote_dns property in firefox config (type about:config in address bar) to TRUE (just double click the property to toggle the value) to enable dns lookups over your local/remote socks5 proxy.
PS: I'm not sure about other ...
I have experienced similar issues. If you are tunneling with Firefox through ssh, some http connections can simply timeout due to server load or improper configuration. When the connection actually does timeout, you'll get an error message like the one you indicated.
You can suppress these messages with the following command
ssh email@example.com -p 1234 -D ...
Looks like this feature has been recently added to docker, particularly in version 1.11.0.
Though there isn't enough documentation about its usage, setting the ALL_PROXY environment variable should work, according to this comment.
$ export ALL_PROXY=socks5://localhost:port
$ docker pull image
I'm not sure about docker-compose at the moment.
If your ...
In this answer I assume that default redis port (6379) is used.
You might create a tunnel via ssh so localhost->6379 will point to mydomainwhatever.net:6379 using this command:
ssh -L 6379:localhost:6379 firstname.lastname@example.org
Then you might connect to localhost:6379 using redis client.
This thread got me doing my own benchmarks and i found out that Performance varies not just by different cipher/MAC it also makes a difference what data you are sending, which CPU's are involved and how networking is set up.
So IMO the right thing to do is run your own tests and find the best settings for your situation.
If someone is interested, here are ...
If you add tunneling to your SSH session, there is an additional data stream created for the tunnel over the same encrypted connection. You also can create more than one tunnel or don't start an interactive session (with the -N parameter). So, basically, there is no real difference, just different methods to use the encrypted connection.
Have a look at this page. It talks about squid socks support and how you can build it to support SOCKS connections. The status is "testing". So, you may need to think about using it for production.
When building squid, you need to define these variables:
export CFLAGS=" -Dbind=SOCKSbind "
export CXXFLAGS=" -Dbind=SOCKSbind "
export LDADD=" -lsocks "
SSH is really a generic secure communication mechanism which can transport arbitrary data over an insecure underlying channel. By default this data is a shell session (i.e. your local terminal is connected to a shell running on the remote system), but there are different types of data which can be transported.
One such type is a stream socket connection (e....
The SSH protocol has no way for clients to tell the server to bind to a certain address when doing a dynamic port forwarding, so no, you can't tell your SSH client to do it. You can't tell the OpenSSH server to do it either. It will blindly use getaddrinfo to connect to your remote host.
The only way to fix is to configure your server so it does what you ...
PC-2 would need access to S-1 in order to initiate a SOCKS connection through S-1 to PC-1.
The SOCKS protocol does support a client binding to ports, but only for the purposes of using a multi-connection protocol (such as FTP). PC-1 can't bind a port that will listen to the world.
You're setting up your SSH SOCKS proxy by SSH'ing to the local machine, and telling it to listen on the unspecified address (0.0.0.0), which translates to ALL IP addresses.
If you're not configuring a firewall to control access to port 1080, then you've just set up an open proxy for anyone to (ab)use.
Tor does not actually make any attempt to verify the authentication information that a SOCKS client provides to it. It can be used entirely unauthenticated, and it has no configuration to force authentication. As such, you are strongly recommended to not expose the SOCKS port to any IP address that you don't want connecting directly to it.
From the man page:...
Open WinBox . Go to IP > Socks > Access . The Socks Access window is similar to filter rule window. Default action in Socks Access is accept. This means that if no rule get matched, socks server accept that connection.
Now add a rule with accept action your LAN IP addresses range as its Src Address. Then add a rule with deny action. Left other field ...
Your thought of using a dynamic port forward for this will never work. Think through it logically - you need to open a local port that forwards from your local machine, through hostA, to port 22 on hostB. There are a couple of ways you can achieve this. First, the inelegant, manual way:
First, set up the tunnel:
$ ssh -L2222:hostB:22 user@hostA
While I haven't tried either of these myself, tun2socks or redsocks seem to do what you're looking for. tun2socks actually creates a new interface, e.g., tun0. I don't think redsocks does, but I may be mistaken.
I was able to compile sshd/ssh with cipher 'none' with the help of this post:
It's a very old post, but you have to make 3 slight modifications to the source code file cipher.c. Then recompile the sshd/ssh code.
@@ -175,7 +175,7 @@
for ((p = strsep(&cp, CIPHER_SEP)); p && *p != '\0';...
Let's split up the problem into two problems.
Reaching the legacy application from your dev environment
Since the firewall admins at your workplace have decided that it should not be possible to reach the legacy app directly from the development network, you have chosen to use an SSH tunnel to work around this.
This is not an approach I'd recommend, but ...
Set the GatewayPorts to yes and try again.
ssh -o 'GatewayPorts yes' email@example.com -p 1234 -D 9898
Specifies that a TCP port on the local machine be forwarded over the secure channel, and the application protocol
is then used to determine where to connect to from the remote machine.
I fixed the issue eventually by removing the version of dante I had installed via apt and replacing it with one I downloaded from the dante website and compiled from source. There must be a bug in the version in ubuntu's repositories.
Actually, when you do:
$ ssh -f -N -D 0.0.0.0:8080 firstname.lastname@example.org
$ curl --socks5 192.168.3.182:8080 ip.appspot.com
The following events occur:
CURL opens a TCP connection from [YOUR-HOST]:[RANDOM-PORT] to the SOCKS server that SSHD runs on 192.168.3.182:8080
SSHD accepts the connection
CURL asks SSHD to open a new connection from 192.168.3.182:[...
SSH is your authentication
If you only want the localhost to access bind it,
ssh -D localhost:port user@host
This ensures that only local programs can access the port.
This is binding to both localhost and all your addresses.
If you want to reduce the login attempts on your ssh just change the default port and rate limit it with iptables,
The proxy built into ssh is a SOCKS proxy, not an HTTP or any other kind of proxy. That said, it's capable of proxying http, as well as just about anything else TCP-based, for a SOCKS-capable client. Firefox is such a client.
You need to make sure that in your browser proxy settings, the entries for HTTP, SSL and FTP proxy are blank; only SOCKS proxy ...
You can configure your socks proxy to listen on a list of IP addresses or 0.0.0.0 (which means all IPs).
It'll work just fine.
You can also configure different instances of the proxy that behave differently or have different configurations on each IP.