Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

As my title suggest, I would like to set up a proxy in linux. The client that I'm using is a mac osx lion. I think I understand the theory but I keep hitting roadblocks.

I started using set proxy server ubuntu linux tutorial here. I already found a spare pc and installed ubuntu 12 on it. According to the article, I have to create an ssh tunnel from how to tunnel traffic with ssh article.

In ubuntu, I made sure that I have ssh server so I did a apt-get install ssh.

Then, it is time to forward ports on my router to individual machine. The individual machine, I assume, is my ubuntu machine which will act as a ssh server. My router is a Cisco Linksys E3000.

As I try to set up port forwarding, I came across this article. This is where it confuses me:

Enter your application name. For a list of which ports an application might use, see the Sources and Citations section below.

It seems that I have to know which application and what port they are using to access the internet??? For example, if I use the terminal in OSX, I need to specify 'Terminal' as the application and know what port it uses? And I need to repeat that for Chrome, firefox, App Store, Diablo 3, etc...?

Is that the standard way of channeling your internet traffic through a proxy so you can bypass firewall?

How do I set up my proxy such that all my internet connections goes through my ubuntu server and channels it back to my client (Mac OSX).

If anyone is interested, I wanted to do this because as I use heroku for my web app deployment, I keep running into firewalls at my workplace, while traveling, etc...

Thanks!!!

share|improve this question
    
are you able to connect to your server using ssh? (ssh [username]@[ip.add.re.ss]) –  adempewolff May 28 '12 at 16:17
    
@adempewolff no. unfortunately not. i receive a connection refuse error. the ip address is actually the ip adress of the router. In the router admin page, i have application name => terminal, external port => 22, internal port => 22, protocol => both, to ip adress => ipadd of my server on the lan. when i issue the command, the terminal just hangs. any idea why? –  Yko May 30 '12 at 0:49
add comment

2 Answers

up vote 6 down vote accepted

Using SSH tunnels: Ports and port forwarding on your router:

Using an ssh tunnel as a proxy involves setting up a local proxy on the default socks5 port (1080). All applications will then send their web traffic to that port, and it will then be sent through the encrypted ssh tunnel to your server and then to the internet.

The only application that your router needs to forward ports for is the ssh client/server--route all incoming TCP requests on port 22, to the IP address of your server on your local network.

Here's a picture illustrating this:

socks5sshtunnel

Let's take a look at the command used to create the SSH tunnel to understand how it works.

ssh -ND 1080 user@11.11.11.111 -p 22

The above command is what creates this tunnel from the client to the server. -D 1080 set what sets up the socks5 proxy at local port 1080 for your applications to use. This is all on your local machine. Port 1080 does not need to be routed anywhere using your router.

user is your username on your server. 11.11.11.111 is the ip address of your server. -p 22 is the port that the ssh client tries to connect to your ssh server using (port 22 is the default so you don't really need to include -p 22 in your command if you haven't changed from the default, I just added it in for explanation purposes). This is the port that you will need to make sure your router is forwarding to your server. If you choose not to use the default ssh port (22) you will also need to configure your ssh server to listen on a different port.

To make applications use this tunnel...

you just have to modify their proxy settings (or use a global proxy--I'm not familiar with how OS X does this though) to use a socks5 proxy at localhost:1080 or 127.0.0.1:1080. For example this is how to do this with Firefox:

Using the menus go to Edit:Preferences:Advanced:Network:(connection)Settings

firefox proxy

To set a global proxy on OS X

I don't use OS X but the OP confirmed that this works (see comments). You can try installing this GUI tool for OS X, navigating to System Preferences -> Network -> Advanced... -> Proxies and entering 127.0.0.1 as the server and 1080 as the port.

Hope this helps.

share|improve this answer
    
+1 just for the graphics... –  rlemon May 28 '12 at 17:04
    
Thanks. I'll try this and I'll let you know if it works. –  Yko May 29 '12 at 16:48
    
@adempewolff. I guess the problem for me is that the ssh server is a linux box that is connected to my home router so it is inside a lan. I left you some details on your comment to my original post about setting up the port forwarding. however, then to use your example, the user@ipaddress part is confusing to me. I know the ipaddress of my router but i don't know what the username is. I tried the user that I use to access the router but the connection timed out. –  Yko May 30 '12 at 1:08
1  
@Yko Two things, 1) yeah, you won't see any output after the ssh -ND 1080 ubuntuusername@routeripadress unless there are errors. 2)because you're at home, you and your server both are behind the same external ip address, whatsmyipaddress.com will show the same address. Chances are it is working but I can't think of a simple way to check without using another network (internet cafe maybe?). If you have a webserver installed on either your server or your mac you could type 127.0.0.1 into your browser and see if anything comes up--but it's not worth installing a webserver just to test this. –  adempewolff May 30 '12 at 3:00
1  
@Yko I noticed this GUI socks5 manager for OS X. You could give it a try. Theoretically OS X should also have global proxy settings somewhere that you could edit through the terminal. Other than that, many applications have command line switches (Chrome's is --proxy-server="socks5://127.0.0.1:1080"). Or for those without native socks5 support you could install tsocks (I think this should be available for OS X), configure it to route to 127.0.0.1:1080, and launch the programs from the terminal with tsocks (for example: tsocks firefox). –  adempewolff May 30 '12 at 14:22
show 7 more comments

If you want to put all your traffic, you need to use a VPN. i would recommend OpenVPN for this, it is quite easy to install and work on both OS X and Linux.

There is already a good documentation on https://help.ubuntu.com/community/OpenVPN.

Another solution is to look at tor, or use ssh -w, but this requires you to change setting of every application to use the proxy.

And if you have trouble at work, i think you should get in touch with your system admin, he can surely open firewall if there is a business reason.

share|improve this answer
    
"If you want to put all your traffic, you need to use a VPN." That is not true. You can use a socks5 ssh tunnel for all traffic using Ubuntu's global proxy settings. –  adempewolff May 28 '12 at 16:03
    
Unfortunately, not all software support socks ( for example, Diablo who was given as example requires to be modified for that ) and not all software follow the global settings. For example, everything using something else than UDP or TCP ( like icmp, sctp, udplite ), would not go to socks, since sock support only TCP and UDP. And Ubuntu here is the server, the client is OS X, and the global proxy setting is for client side. –  Misc May 28 '12 at 16:09
    
Ah, I missed that example applications part in the question and completely forgot that OS X is the client, oops! I agree with you that openVPN is the more complete solution but it is also a huge pain to properly configure the server--since the poster is having trouble configuring an ssh tunnel I wouldn't want to throw something even more complicated at them as a solution. I would still recommend using a global socks5 proxy, and then something like tsocks for Diablo 3 and other non socks5-compliant apps. –  adempewolff May 28 '12 at 16:15
    
Ya I think eventually I wanted to be able to go the openVPN route. Diablo is very low on the importance list so right now, I just want it to do simple ssh tunneling. –  Yko May 29 '12 at 16:49
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.