Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Be your own VPN provider with OpenBSD

networkfilter.blogspot.com

Post reply on HN
Print view View original

21–30 of 63 posts

Re: Be your own VPN provider with OpenBSD

#21

Post by rufugee »

delsarto wrote: post #12
cfallin wrote: post #2

If anyone's ever looking for an even quicker hack, ssh has built-in the ability to act as a SOCKS5 proxy, tunneling your traffic over ssh to whatever remote machine you might have access to: $ ssh -D 1080 myserver.myhost.net Then configure Chrome or Firefox or whatever to use a SOCKS5 proxy on localhost, port 1080. (N.B. that this does not tunnel DNS lookups by default.) The OpenVPN-based route is the way to go for s…

I think the fact that this leaks DNS lookups is really quite key because that gives away a huge amount about what you're looking at over your "vpn", not to mention services like netflix that are pointing you to different responses based upon the source of your dns lookups. In firefox you want to go to about:config page and turn on network.proxy.socks_remote_dns

Nice! I've been using dnsmasq to route my DNS queries and prevent leakage. Didn't realize the nework.proxy.socks_remote_dns option existed. Thanks for sharing!

Re: Be your own VPN provider with OpenBSD

#23

Post by ReidZB »

delsarto wrote: post #12
cfallin wrote: post #2

If anyone's ever looking for an even quicker hack, ssh has built-in the ability to act as a SOCKS5 proxy, tunneling your traffic over ssh to whatever remote machine you might have access to: $ ssh -D 1080 myserver.myhost.net Then configure Chrome or Firefox or whatever to use a SOCKS5 proxy on localhost, port 1080. (N.B. that this does not tunnel DNS lookups by default.) The OpenVPN-based route is the way to go for s…

I think the fact that this leaks DNS lookups is really quite key because that gives away a huge amount about what you're looking at over your "vpn", not to mention services like netflix that are pointing you to different responses based upon the source of your dns lookups. In firefox you want to go to about:config page and turn on network.proxy.socks_remote_dns

I'm using the latest stable release of Firefox (34.0.5) and I see a "Remote DNS" checkbox under my SOCKS proxy configuration. Isn't that the same option in the GUI? No about:config tweaks needed?

I would think so, but everyone seems to be giving the about:config business, so maybe I am missing something.

Re: Be your own VPN provider with OpenBSD

#24

Post by higherpurpose »

Why not use SigmaVPN over OpenVPN? From what I gathered from the CCC talks OpenVPN can fall pretty easily to NSA.

http://frozenriver.net/SigmaVPN

Last talk on HN about it: https://news.ycombinator.com/item?id=7599091

There seems to be this similar project as well:

https://github.com/zerotier/ZeroTierOne

Re: Be your own VPN provider with OpenBSD

#25

Post by ewang1 »

cfallin wrote: post #2

If anyone's ever looking for an even quicker hack, ssh has built-in the ability to act as a SOCKS5 proxy, tunneling your traffic over ssh to whatever remote machine you might have access to: $ ssh -D 1080 myserver.myhost.net Then configure Chrome or Firefox or whatever to use a SOCKS5 proxy on localhost, port 1080. (N.B. that this does not tunnel DNS lookups by default.) The OpenVPN-based route is the way to go for s…

Would setting it as a proxy under the network connection (i.e. Network > Advanced in OS X) force all traffic (including DNS) over the proxy?

Re: Be your own VPN provider with OpenBSD

#26

Post by ForestC »

cfallin wrote: post #2

If anyone's ever looking for an even quicker hack, ssh has built-in the ability to act as a SOCKS5 proxy, tunneling your traffic over ssh to whatever remote machine you might have access to: $ ssh -D 1080 myserver.myhost.net Then configure Chrome or Firefox or whatever to use a SOCKS5 proxy on localhost, port 1080. (N.B. that this does not tunnel DNS lookups by default.) The OpenVPN-based route is the way to go for s…

Ah yes, ssh tunneling. The high school IT initiate's go-to method to dodge the web filter. It really can be an elegant solution when you don't have the patience to rev up OpenVPN for real.

Re: Be your own VPN provider with OpenBSD

#27

Post by delsarto »

ReidZB wrote: post #23
delsarto wrote: post #12

Earlier quoted context omitted.

I think the fact that this leaks DNS lookups is really quite key because that gives away a huge amount about what you're looking at over your "vpn", not to mention services like netflix that are pointing you to different responses based upon the source of your dns lookups. In firefox you want to go to about:config page and turn on network.proxy.socks_remote_dns

I'm using the latest stable release of Firefox (34.0.5) and I see a "Remote DNS" checkbox under my SOCKS proxy configuration. Isn't that the same option in the GUI? No about:config tweaks needed? I would think so, but everyone seems to be giving the about:config business, so maybe I am missing something.

Most probably it has been added, my notes from this are from 2008 so it's hardly cutting edge! :)

Re: Be your own VPN provider with OpenBSD

#28

Post by rahimnathwani »

guelo wrote: post #10

The disadvantage of this over a shared VPN that doesn't keep logs is that there's now a unique IP address that can be tied back to you. A cool feature for a VPS would be to have a shared IP address between a bunch of customers.

Some VPS providers _do_ provide shared IPv4 address, as a way to reduce their costs. A set number (e.g. 20) of ports are forwarded to the VPS' internal IPv4 address.

For example: http://lowendspirit.com/

Any VPS which provides 'only' IPv6 will typically support outbound IPv4 via NAT, with that IPv4 address being shared between all customers on the same node.

Re: Be your own VPN provider with OpenBSD

#29

Post by Juha »

delsarto wrote: post #12
cfallin wrote: post #2

If anyone's ever looking for an even quicker hack, ssh has built-in the ability to act as a SOCKS5 proxy, tunneling your traffic over ssh to whatever remote machine you might have access to: $ ssh -D 1080 myserver.myhost.net Then configure Chrome or Firefox or whatever to use a SOCKS5 proxy on localhost, port 1080. (N.B. that this does not tunnel DNS lookups by default.) The OpenVPN-based route is the way to go for s…

I think the fact that this leaks DNS lookups is really quite key because that gives away a huge amount about what you're looking at over your "vpn", not to mention services like netflix that are pointing you to different responses based upon the source of your dns lookups. In firefox you want to go to about:config page and turn on network.proxy.socks_remote_dns

I have been using Chrome/FF extension called FoxyProxy, it tunnels the DNS requests through the SOCKS proxy.

Re: Be your own VPN provider with OpenBSD

#30

Post by chrissnell »

delsarto wrote: post #12
cfallin wrote: post #2

If anyone's ever looking for an even quicker hack, ssh has built-in the ability to act as a SOCKS5 proxy, tunneling your traffic over ssh to whatever remote machine you might have access to: $ ssh -D 1080 myserver.myhost.net Then configure Chrome or Firefox or whatever to use a SOCKS5 proxy on localhost, port 1080. (N.B. that this does not tunnel DNS lookups by default.) The OpenVPN-based route is the way to go for s…

I think the fact that this leaks DNS lookups is really quite key because that gives away a huge amount about what you're looking at over your "vpn", not to mention services like netflix that are pointing you to different responses based upon the source of your dns lookups. In firefox you want to go to about:config page and turn on network.proxy.socks_remote_dns

I believe that Mac OS X does tunnel DNS when you configure the proxy through Control Panel -> Network. I used this when I was in the Army and lived in housing whose internet connections were managed by a crappy ISP that did DNS-based filtering of sites they deemed objectionable.
Post reply on HN