No technical expert advice can be found here ;)
Weblog by Erik Scholtz
Bypass a firewall Part II – Secure Tunnel through the firewall
*WOW* – the resonse to my last article is overwhelming! The article is just a week old, but my mailbox is already full of emails asking me, if there is a way to use SOCKS over a secure connection like SSH.
To prevent my mailbox from several hundrets of further emails: YES THERE IS A WAY!
Building a SOCKS Proxy over SSH
Building a SOCKS Proxy over SSH
All you need to realize a SOCKS5 tunnel over SSH is an openSSH on your “SOCKS-Server” and the already used “Proxifier”, as well as PuTTY on Windows-based systems.
First of all, you need to build up the secure tunnel (type the command into your OS X console):
ssh -2 -N -D 8080 user@<ip of your SOCKS5-Host>
for example:
ssh -2 -N -D 8080 myuser@192.168.1.11
On Windows, the configuration of PuTTY is the following:
Add the Hostname (for example: 192.168.1.11 – you need to add your SSH/SOCKS-Server IP there) under Tab “Sessions”
Then go to Tab “Tunnels” and enter Source Port 8080
Select “Dynamic” from the Destination Port
Click Open to buildup the tunnel
Now start the Proxifier and add the following Setting:
I find it usefull (but it is not neccessary) to add a rule to the Proxification Rules:
That’s all: openSSH has an integrated SOCKS-Proxy. Proxifier sends all traffic through the SSH-Tunnel (which is encrypted) and the SOCKS-proxy in openSSH on the other side sends the traffic to the destination hosts and returns incomming traffic to you.
Break through a firewall – SOCKS (dante) tunnel and OS X
New customers, new problems: I am used to get internet-access over the Intranet of my customers and can build up a VPN connection or SSH/SSL connections, so I can reach my IMAP-Mailbox in a secure way. This time I got completely blocked – only port 80 was allowed – and for me being without emails is like living without breathing. So my first plan here was to break through this firewall and get my connections through it.
I did something similar a couple of years before on our university-network, when the admins there decided to block the traffic of the dorm and limit it to port 21/80. So my first idea was a SOCKS-tunnel.
Providing the SOCKS-Tunnel
After asking google for SOCKS I found a recommended implementation of SOCKS5: Dante
There is a very nice overview of SOCKS-implementations on wikipedia: http://en.wikipedia.org/wiki/SOCKS
Installation
Installation was quite easy: On SuSE it is a rpm you simply install, on FreeBSD you find it in the ports (cd /usr/ports/net/dante/; make; make install ). More interesting got the configuration of Dante, and that is what I want to explain today (since I did not find a howto and had to read the documentation):
Configuration
The config-file can be found in /etc/sockd.conf (/usr/local/etc/sockd.conf on FreeBSD). This you have to edit in the following way:
#define the logfile for dante
logoutput: /var/log/dante.log#define the IP/Port Dante should listen for connections
internal: <IP address of your dante server> port = 80#define the IP/interface Dante should use for outgoing connections
# Check the name of your interface using ifconfig
external: eth0
#Alternative: >external: <IP address that should be used>#authentication: deactivated, since I will use a static IP-adress – that is auth enough now!
method: username none#unprivileged user for Dante
user.notprivileged: nobody
Ok – that was the basic stuff – now the interesting part:
#Who can access this SOCKS Tunnel?
client pass {
from: <your ip here>/32 port 1-65535 to: 0.0.0.0/0
}#Loopback may also access the tunnel
client pass {
from: 127.0.0.0/8 port 1-65535 to: 0.0.0.0/0
}#Block all others
client block {
from: 0.0.0.0/0 to: 0.0.0.0/0
log: connect error
}# Once connected, who may be connected then?
# block connections from anywhere to loopback
block {
from: 0.0.0.0/0 to: 127.0.0.0/8
log: connect error
}# Allow connections from anywhere to client
pass {
from: <your ip here>/32 to: 0.0.0.0/0
protocol: tcp udp
}pass {
from: 127.0.0.0/8 to: 0.0.0.0/0
protocol: tcp udp
}#Block the rest
block {
from: 0.0.0.0/0 to: 0.0.0.0/0
log: connect error
}
Please note: this example will limit the access to one IP (/32), you can also allow more IPs. If you are not firm to subnetting, use the Subnet Cheat Sheet
Starting up Dante
After this simple configuration, your Dante-server should start without any problems, by typing:
/etc/rc.d/sockd start
(On FreeBSD first add sockd_enable=”YES” to your /etc/rc.conf, then type: /usr/local/etc/rc.d/sockd start ). Now you can watch your logfile under /var/log/dante.log to see what is going on.
Now let’s come to the complicated part: Make OSX work with the SOCKS5 tunnel we created.
Making OSX using the SOCKS5 tunnel
The first (and unsuccessfull) idea was, to configure it in in the network setup in the System Preferences. (Go to the Network preference pane, then click on further options and go to the “Proxies” tab. Enable SOCKS Proxy and fill in the IP of your server and the correct port, save the changes and activate the setting). Unfortunatly, this setting only works only for Cocoa and WebKit-based applications (and since not all of these applications use the System Preferences, you are covered only by 95% there too).
Screenshot Systempreferences network german
Thunderbird and Firefox for example doe not use the System preferences. You can both configure them to make them use the SOCKS tunnel, but to be honest: I do not want to reconfigure my applications on every new place. So I looked for a general SOCKS-Proxy.
After some search I found Proxifier – a commercial product, that is easy to setup easy to use and does everything you need with just a few clicks. There is also a version for Windows, that I did not check out, but I’m sure it will work as good as the OS X-version does.
The SetUp is easy and does not need the really good documentation that is provided on the Proxifier-homepage. If you feel better by watching the dosumentation, here you will find it: http://www.proxifier.com/mac/documentation/ProxifierHelp.html
After starting and configuring Proxifier, I got back online to the world, bypassing the firewall of my customer over port 80.
ATTENTION: Dante and SOCKS may not be confused with VPN, even if it is the same feeling! The data is send clear-text and my be visualized with any Packet-Sniffer!
Get in contact:
