Hot answers tagged

22

I know the answer is bit late, but for the reference and for those who are still looking for the answer, Set the network.proxy.socks_remote_dns property in firefox config (type about:config in address bar) to TRUE (just double click the property to toggle the value) to enable dns lookups over your local/remote socks5 proxy. PS: I'm not sure about other ...


21

I have experienced similar issues. If you are tunneling with Firefox through ssh, some http connections can simply timeout due to server load or improper configuration. When the connection actually does timeout, you'll get an error message like the one you indicated. You can suppress these messages with the following command ssh user@xx.yy.zz.41 -p 1234 -D ...


18

Looks like this feature has been recently added to docker, particularly in version 1.11.0. Though there isn't enough documentation about its usage, setting the ALL_PROXY environment variable should work, according to this comment. $ export ALL_PROXY=socks5://localhost:port $ docker pull image I'm not sure about docker-compose at the moment. If your ...


9

In this answer I assume that default redis port (6379) is used. You might create a tunnel via ssh so localhost->6379 will point to mydomainwhatever.net:6379 using this command: ssh -L 6379:localhost:6379 user@mydomainwhatever.net Then you might connect to localhost:6379 using redis client.


7

ssh -o ProxyCommand='nc -x 127.0.0.1:30000 %h %p' user@destination.com where 127.0.0.1:30000 is the socks5 proxy. Credit: Jethro Carr


6

This thread got me doing my own benchmarks and i found out that Performance varies not just by different cipher/MAC it also makes a difference what data you are sending, which CPU's are involved and how networking is set up. So IMO the right thing to do is run your own tests and find the best settings for your situation. If someone is interested, here are ...


6

If you add tunneling to your SSH session, there is an additional data stream created for the tunnel over the same encrypted connection. You also can create more than one tunnel or don't start an interactive session (with the -N parameter). So, basically, there is no real difference, just different methods to use the encrypted connection.


6

Have a look at this page. It talks about squid socks support and how you can build it to support SOCKS connections. The status is "testing". So, you may need to think about using it for production. When building squid, you need to define these variables: export CFLAGS=" -Dbind=SOCKSbind " export CXXFLAGS=" -Dbind=SOCKSbind " export LDADD=" -lsocks " to ...


5

SSH is really a generic secure communication mechanism which can transport arbitrary data over an insecure underlying channel. By default this data is a shell session (i.e. your local terminal is connected to a shell running on the remote system), but there are different types of data which can be transported. One such type is a stream socket connection (e....


5

The SSH protocol has no way for clients to tell the server to bind to a certain address when doing a dynamic port forwarding, so no, you can't tell your SSH client to do it. You can't tell the OpenSSH server to do it either. It will blindly use getaddrinfo to connect to your remote host. The only way to fix is to configure your server so it does what you ...


5

PC-2 would need access to S-1 in order to initiate a SOCKS connection through S-1 to PC-1. The SOCKS protocol does support a client binding to ports, but only for the purposes of using a multi-connection protocol (such as FTP). PC-1 can't bind a port that will listen to the world.


5

You're setting up your SSH SOCKS proxy by SSH'ing to the local machine, and telling it to listen on the unspecified address (0.0.0.0), which translates to ALL IP addresses. If you're not configuring a firewall to control access to port 1080, then you've just set up an open proxy for anyone to (ab)use.


5

Tor does not actually make any attempt to verify the authentication information that a SOCKS client provides to it. It can be used entirely unauthenticated, and it has no configuration to force authentication. As such, you are strongly recommended to not expose the SOCKS port to any IP address that you don't want connecting directly to it. From the man page:...


5

Open WinBox . Go to IP > Socks > Access . The Socks Access window is similar to filter rule window. Default action in Socks Access is accept. This means that if no rule get matched, socks server accept that connection. Now add a rule with accept action your LAN IP addresses range as its Src Address. Then add a rule with deny action. Left other field ...


5

Your thought of using a dynamic port forward for this will never work. Think through it logically - you need to open a local port that forwards from your local machine, through hostA, to port 22 on hostB. There are a couple of ways you can achieve this. First, the inelegant, manual way: First, set up the tunnel: $ ssh -L2222:hostB:22 user@hostA Then, ...


4

Use a setup similar to the redsocks README and the iptables RANDOM module to load balance/redirect each connection startup to each real proxy.


4

While I haven't tried either of these myself, tun2socks or redsocks seem to do what you're looking for. tun2socks actually creates a new interface, e.g., tun0. I don't think redsocks does, but I may be mistaken.


4

I was able to compile sshd/ssh with cipher 'none' with the help of this post: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=24559#58 It's a very old post, but you have to make 3 slight modifications to the source code file cipher.c. Then recompile the sshd/ssh code. @@ -175,7 +175,7 @@ for ((p = strsep(&cp, CIPHER_SEP)); p && *p != '\0';...


4

Let's split up the problem into two problems. Reaching the legacy application from your dev environment Since the firewall admins at your workplace have decided that it should not be possible to reach the legacy app directly from the development network, you have chosen to use an SSH tunnel to work around this. This is not an approach I'd recommend, but ...


3

I haven't test yet SS5_LOG_FILE sets absolute pathname of ss5 log file e.g: set SS5_LOG_FILE /dev/null or Edit /etc/sysconfig/ss5 and add following line: SS5_OPTS=" -m"


3

Set the GatewayPorts to yes and try again. ssh -o 'GatewayPorts yes' user@xx.yy.zz.41 -p 1234 -D 9898 man ssh_config DynamicForward Specifies that a TCP port on the local machine be forwarded over the secure channel, and the application protocol is then used to determine where to connect to from the remote machine. The ...


3

I fixed the issue eventually by removing the version of dante I had installed via apt and replacing it with one I downloaded from the dante website and compiled from source. There must be a bug in the version in ubuntu's repositories.


3

Actually, when you do: $ ssh -f -N -D 0.0.0.0:8080 root@192.168.3.182 $ curl --socks5 192.168.3.182:8080 ip.appspot.com The following events occur: CURL opens a TCP connection from [YOUR-HOST]:[RANDOM-PORT] to the SOCKS server that SSHD runs on 192.168.3.182:8080 SSHD accepts the connection CURL asks SSHD to open a new connection from 192.168.3.182:[...


2

SSH is your authentication If you only want the localhost to access bind it, ssh -D localhost:port user@host This ensures that only local programs can access the port. vs *:port This is binding to both localhost and all your addresses. If you want to reduce the login attempts on your ssh just change the default port and rate limit it with iptables, I ...


2

Socks5 will not work for UDP packets. So you can setup an openvpn and just put everything through there. If you want something for just one program, you could try ctunnel.


2

The proxy built into ssh is a SOCKS proxy, not an HTTP or any other kind of proxy. That said, it's capable of proxying http, as well as just about anything else TCP-based, for a SOCKS-capable client. Firefox is such a client. You need to make sure that in your browser proxy settings, the entries for HTTP, SSL and FTP proxy are blank; only SOCKS proxy ...


2

You can configure your socks proxy to listen on a list of IP addresses or 0.0.0.0 (which means all IPs). It'll work just fine. You can also configure different instances of the proxy that behave differently or have different configurations on each IP.


2

Using Peter Krumin's article here: ssh -f -N -D 0.0.0.0:1080 localhost I agree this isn't ideal, so you may want to look at something like Dante. I believe socat can do the same thing.


2

I don't think it is possible with OpenSSH. You will need to use a Socks5 proxy server like Dante.


2

A quick search would yield you a result for Internet Connection Sharing. http://technet.microsoft.com/en-us/library/cc770507(v=ws.10).aspx


Only top voted, non community-wiki answers of a minimum length are eligible