Proxy over SSH: Difference between revisions
From Rabbi Blog
(Migration - Proxy over SSH) |
m (→No Need For A Squid: corrected word (wouldn't -> would)) |
||
| (3 intermediate revisions by the same user not shown) | |||
| Line 17: | Line 17: | ||
* Open putty and connect to your home network SSH server | * Open putty and connect to your home network SSH server | ||
* Add the tunnel for the proxy server (3128 for squid) | * Add the tunnel for the proxy server (3128 for squid) | ||
** See the previously mentioned [[VNC over SSH|article] on this | ** See the previously mentioned [[VNC over SSH|article]] on this | ||
* Open IE or Firefox (or whatever) | * Open IE or Firefox (or whatever) | ||
** Add the following LAN Proxy settings: 127.0.0.1:3128 | ** Add the following LAN Proxy settings: 127.0.0.1:3128 | ||
| Line 34: | Line 34: | ||
=Further applications= | =Further applications= | ||
* Reroute your email client through the tunnel | * Reroute your email client through the tunnel | ||
=No Need For A Squid= | |||
From one of my gaming friends (Thanks Nightwalker): | |||
<pre> | |||
OpenSSH has native support for Socks4/5 built-in, so there is no need to run a squid server. | |||
Simply create a dynamic tunnel on localhost, port 1234 etc, and then use that port information for your socks5 server in Firefox / IE etc. | |||
I do the same thing on my Linux home box using a package called 'autossh' which maintains the connection for me. | |||
In Putty, radio 'Dynamic, IPV4' | |||
Source Port: 8081 | |||
Destination: 127.0.0.1 | |||
Will show up as '4D8081'. | |||
Now in your favorite browser use localhost:8081 | |||
And you can connect via your tunnel using socks directly. No Squid required. | |||
The only 'leakage' using this method is DNS. While using a squid proxy, the DNS would be visible. | |||
I mainly use this method when I am traveling using a public wifi connection. | |||
</pre> | |||
=Related Articles= | =Related Articles= | ||
| Line 40: | Line 66: | ||
[[Category:Programs]] | [[Category:Programs]] | ||
[[Category:Security]] | [[Category:Security]] | ||
[[Category:2007-03]] | [[Category:Weblog-2007-03]] | ||
Latest revision as of 10:59, 30 July 2008
History
Basing this post on the previous VNC over SSH article, I was thinking of a way to be slightly more secure while using Wireless Hot Spots (Internet Cafes for example), where someone with sniffing programs could be lifting your username, passwords and email that you read right from the wireless connection.
Ingredients
- A proxy server running in your 'home' network
- SSH server running on the same box (or on your home network for advanced users)
- An open port in your firewall pointing to the SSH server (changing your SSH port is recommended for security)
- Putty on your laptop (or remote PC)
Prerequisites
- Setup your proxy server and record the port that it runs on. I'm using Squid proxy (port 3128)
Remote Laptop Steps
- Open putty and connect to your home network SSH server
- Add the tunnel for the proxy server (3128 for squid)
- See the previously mentioned article on this
- Open IE or Firefox (or whatever)
- Add the following LAN Proxy settings: 127.0.0.1:3128
Enjoy surfing via your secure SSH tunnel!
Verify
To verify this is working, do the following:
- Browse to www.whatismyip.com and note the IP
- Perform the Remote Laptop Steps
- Browse to www.whatismyip.com and note the IP
You should notice a DIFFERENT IP and you should recognize it as your home network's external IP.
Further applications
- Reroute your email client through the tunnel
No Need For A Squid
From one of my gaming friends (Thanks Nightwalker):
OpenSSH has native support for Socks4/5 built-in, so there is no need to run a squid server. Simply create a dynamic tunnel on localhost, port 1234 etc, and then use that port information for your socks5 server in Firefox / IE etc. I do the same thing on my Linux home box using a package called 'autossh' which maintains the connection for me. In Putty, radio 'Dynamic, IPV4' Source Port: 8081 Destination: 127.0.0.1 Will show up as '4D8081'. Now in your favorite browser use localhost:8081 And you can connect via your tunnel using socks directly. No Squid required. The only 'leakage' using this method is DNS. While using a squid proxy, the DNS would be visible. I mainly use this method when I am traveling using a public wifi connection.