If anyone's ever looking for an even quicker hack, ssh has built-in the ability to act as a SOCKS5 proxy, tunneling your traffic over ssh to whatever remote machine you might have access to: $ ssh -D 1080 myserver.myhost.net Then configure Chrome or Firefox or whatever to use a SOCKS5 proxy on localhost, port 1080. (N.B. that this does not tunnel DNS lookups by default.) The OpenVPN-based route is the way to go for s…
I think the fact that this leaks DNS lookups is really quite key because that gives away a huge amount about what you're looking at over your "vpn", not to mention services like netflix that are pointing you to different responses based upon the source of your dns lookups. In firefox you want to go to about:config page and turn on network.proxy.socks_remote_dns
Be your own VPN provider with OpenBSD
31–40 of 63 posts
Re: Be your own VPN provider with OpenBSD
#32I've been considering running all my mobile data through a VPN for better security, and saving all of it so I can analyze anything after the fact. Anyone doing anything like this?
Keeping a VPN connection alive doesn't do the battery any favors, and bringing up a VPN connection isn't that fast to do it on-demand.
I am often dependent on a high-latency GPRS link, and the overhead of establishing a tunnel using OpenVPN or SSH (e.g. sshuttle) is prohibitive. OpenVPN is very likely to timeout before it can negotiate a TLS session. This is one of the major reasons why I wrote my own VPN software[1] using NaCl. Deterministic public-key encryption means that there is no negotiation required at startup. The tunnel is therefore ready to use as soon as the program is started. To me, that's the difference between a usable connection and nothing at all.
Re: Be your own VPN provider with OpenBSD
#33Why go through all those hoops when there are plenty of open source VPNs installed with one line. eg https://github.com/sockeye44/instavpn <- works with mac, ios, android etc
Re: Be your own VPN provider with OpenBSD
#34If anyone's ever looking for an even quicker hack, ssh has built-in the ability to act as a SOCKS5 proxy, tunneling your traffic over ssh to whatever remote machine you might have access to: $ ssh -D 1080 myserver.myhost.net Then configure Chrome or Firefox or whatever to use a SOCKS5 proxy on localhost, port 1080. (N.B. that this does not tunnel DNS lookups by default.) The OpenVPN-based route is the way to go for s…
Even better trick is SSH can actually tunnel level 3 data! Via TUN/TAP interfaces (this is effectively how some VPN implementations do it). See "-w" option Here are a few guides. This is more involved than just adding the -D option and setting a "proxy" field in some applications but this is more general as well: http://sleepyhead.de/howto/?href=vpn https://wiki.archlinux.org/index.php/VPN_over_SSH https://help.ubunt…
Yes, except for the TCP-over-TCP issue.
Re: Be your own VPN provider with OpenBSD
#35What I really want to do is set up something like the "UnblockUs" proxy servers, where it's all done through DNS or something similar. The key reason is for Netflix access here in Australia, through my Apple TV. Ideally it'd be at my router level, to require no config on the boxes themselves, and be able to have a filter list where certain hosts on that list are proxied and others aren't.
Last time I checked there were some nascent projects to do this in a FOSS way, but they weren't complete and most seemed abandoned. Any ideas?
Re: Be your own VPN provider with OpenBSD
#36Earlier quoted context omitted.
Even better trick is SSH can actually tunnel level 3 data! Via TUN/TAP interfaces (this is effectively how some VPN implementations do it). See "-w" option Here are a few guides. This is more involved than just adding the -D option and setting a "proxy" field in some applications but this is more general as well: http://sleepyhead.de/howto/?href=vpn https://wiki.archlinux.org/index.php/VPN_over_SSH https://help.ubunt…
Yes, except for the TCP-over-TCP issue.
Great point, Colin. That probably explains why it is not more popular (or it is rather a new-ish feature...).
I was just surprised it was there.
Re: Be your own VPN provider with OpenBSD
#37Why not just use npppd, which is in the base install, and then use L2TP/IPsec?
http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man8/...
Re: Be your own VPN provider with OpenBSD
#38What I really want to do is set up something like the "UnblockUs" proxy servers, where it's all done through DNS or something similar. The key reason is for Netflix access here in Australia, through my Apple TV. Ideally it'd be at my router level, to require no config on the boxes themselves, and be able to have a filter list where certain hosts on that list are proxied and others aren't. Last time I checked there we…
What these services do is spoof the DNS replies -- redirecting your apps towards their reverse proxies.
Eventually this will break due to a) DNSsec, and b) encrypted netflix traffic.
Better come up with a more robust VPN solution. DNS hacks will work until Netflix actually cares enough to stop them.
Re: Be your own VPN provider with OpenBSD
#39If anyone's ever looking for an even quicker hack, ssh has built-in the ability to act as a SOCKS5 proxy, tunneling your traffic over ssh to whatever remote machine you might have access to: $ ssh -D 1080 myserver.myhost.net Then configure Chrome or Firefox or whatever to use a SOCKS5 proxy on localhost, port 1080. (N.B. that this does not tunnel DNS lookups by default.) The OpenVPN-based route is the way to go for s…
Would setting it as a proxy under the network connection (i.e. Network > Advanced in OS X) force all traffic (including DNS) over the proxy?
You could configure a transparent proxy with Privoxy set to use a custom dns server with dnsmasq and foxy-proxy to configure firefox to use that to forward dns request through your proxy.
Re: Be your own VPN provider with OpenBSD
#40The disadvantage of this over a shared VPN that doesn't keep logs is that there's now a unique IP address that can be tied back to you. A cool feature for a VPS would be to have a shared IP address between a bunch of customers.
I was going to comment with this. I have a VPS and have thought about running a VPN from there. This would protect me from a whole lot of man in the middle attacks as well as preventing the ISP's on snooping in on my traffic.
However, another big advantage to a VPN for me is anonimity, not directly giving the site information on who you are. If you were to set this up and use it just for you it's not unthinkable that government organisations like the NSA in Amerika and the AIVD in my homecountry of the Netherlands could identify you pretty easily.
For that I use Private Internet Access[1] right now, they claim to have patched a lot of the important software to have no logging, so they can't keep them. They also share IP addresses between customers which means the IP address is not a form of identification anymore. Their site looks like shit, I agree, but the service is pretty great.