ssh tunneling: how to ?
 

I want to use ssh tunneling via a proxy server.
So I do (as root) on the tablet

ssh -D80 user@myserver.com

and the I want to set the proxy for the browser to localhost:80 but I cannot set the proxy. I can only set the proxy per connection, which means that the ssh connection also goes over the proxy.

Is there a way that I can only proxy certain ports or with a particular program ?

UPDATE: I found in this thread http://www.internettablettalk.com/fo...ad.php?t=11294
that I can set a proxy in about:config.
It did work with the same wrong result as setting the connection proxy:
while
ssh -D 80 user@myserver

was open, the browser returned an empty page without error.

Any ideas on this ?

Re: ssh tunneling: how to ?
 

skatebiker:

Try a different proxy port. You shouldn't use port 80, since that is the "normal" HTTP port. Use something like 3210 (as in my example), because that is an unused port.

I haven't tried this for many months, but it should still work...

EDIT: Just tested things, still works!

EDIT2: Looks like you just have to hit your "turn proxy on" bookmark to turn the proxy on, rather than load the bookmark and then hit the submit button like you used to have to do.

EDIT3: don't forget to set network.proxy.socks_remote_dns to 1 or true for properly secure browsing...

Re: ssh tunneling: how to ?
 

why the -D, and not -L? what does the Dynamic functionality offer?

Re: ssh tunneling: how to ?
 

A SOCKS proxy, which can proxy any connection to anywhere, instead of a simple port-forward. With -L, you'd have to make a new one for each host you wanted to browse to, or (more feasibly) have a remote (HTTP or SOCKS) proxy and forward everything to it.

With -D, you don't need the remote proxy.

Re: ssh tunneling: how to ?
 

Not sure if it's what you're after, but I run a squid proxy at home, set up an ssh tunnel, and I change the proxy settings to route http and https traffic across the tunnel. Rather than being an application setting, it's an advanced setting in the connection dialog.

Either method you choose, use it in conjunction with dbus-scripts to have the tunnel established whenever you connect to a wifi access point.

Re: ssh tunneling: how to ?
 

Bit I see also a setting

network.proxy.http localhost
network.proxy.http_port 80

How can I remove these settings ?
The about config does not have an option to remove settings.
Setting an empty string does not remove it.

Re: ssh tunneling: how to ?
 

ok, so -D is a socks-like attempt to proxy connections, but not really a socks proxy?

also, from my readings on privoxy and tor, does the -D forwarding "leak" DNS queries like socks4? when using privoxy in combination with tor, one must forward requests from privoxy to tor using only forward-socks4a directives to avoid DNS leaks.

Re: ssh tunneling: how to ?
 

I finally succeeded with -D 3210.

I filled in
network.proxy.http <empty>
network.proxy.http_port 0

restarted the browser by clicking on a bookmark which sets network.proxy.type to 1.
Then I saw the IP address of the proxy to which I had an open SSH connection with -D 3210.

Re: ssh tunneling: how to ?
 

It is a SOCKS proxy, just one that happens to route all proxied connections via a secure channel to the remote server.

AFAIK, it's SOCKS4/5 (not 4a, so requires IPs, not FQDNs), but it can handle any traffic, including DNS, if you make the DNS requests through the proxy. So if you can make your software (e.g. MicroB, which can) perform DNS lookup via TCP, you can push it through SOCKS to the DNS server, and then make a connection to the resulting IP through SOCKS. Qole's instructions included a setting for that. (I think...)

With an appropriately compiled TSOCKS, also, DNS can be forced to TCP, and SOCKSified. I'm not sure if a version compiled that way is about. (And TSOCKS, if you can get it working right, makes everything run through the tunnel instead of configuring each app separately.)

Finally, you could just use socat or netcat to run DNS over UDP over TCP over SSH -- it's not as hard as it sounds.

Re: ssh tunneling: how to ?
 

I mentioned it in this thread, but my original instructions don't mention it.

Except the browser, sadly, which is why you have to do this convoluted way using about:config instead of the much more elegant tsocks.

There may be a way to restart browserd so that it uses tsocks, but in my experience, restarting browserd tends to have unwanted side effects.