Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I've been using an ssh tunnel for browsing, reading that doing so would encrypt the connection to the internet. However, i have no idea as to what kind of protection that the ssh tunnel really provide.

Does it just protect my connection from network/packet sniffers or does it block out my ISP as well?

EDIT: Also, must i use a remote server to ssh to or can i just tunnel to localhost and still have the same effects? e.g the command i use now is ssh localhost -p 22 -ND 8080

share|improve this question
    
I don't have an answer to your question as such, but have a look at the Tor Project for anonymous browsing. torproject.org –  Clive van Hilten Jun 7 '12 at 20:33
    
Based on the website; Using Tor protects you against a common form of Internet surveillance known as "traffic analysis." is an ssh tunnel limited to that? –  Rey Leonard Amorato Jun 7 '12 at 20:38
    
Please remember to accept/upvote the best answer to your question (tick/check mark on the left). This way, the question is marked as "answered" and future readers can refer to it knowing the solution works. Thank you...:) –  izx Jun 16 '12 at 10:54
    
Yes, thank you for reminding me. I still have some unanswered questions (above edit and comment on your answer). If you could perhaps shed some light on those, that'd be great. –  Rey Leonard Amorato Jun 16 '12 at 16:26

1 Answer 1

up vote 2 down vote accepted

Does it just protect my connection from network/packet sniffers or does it block out my ISP as well?

It also blocks out your ISP completely if and only if DNS lookups are also tunneled, and not done in the clear or worse, from the ISP's own DNS servers.

What I mean is, suppose you want to visit www.wikileaks.org over your SSH-SOCKS proxy. What your browser will almost certainly do is use regular DNS to resolve www.wikileaks.org to an IP, but then tunnel all traffic to that IP over the proxy. So your ISP (or a sniffer) could tell that you wanted to visit wikileaks.org, but not what page you wanted to see (or saw).

The solution is to also tunnel DNS lookups over the proxy.

  • For Firefox, it's as simple as typing about:config and changing the network.proxy.socks_remote_dns setting to true.

  • Chromium (or Chrome) will only do this if you are using a Socks 5 proxy!

  • The global way to do this is to set your DNS using NetworkManager to localhost, where you forward port '53' over SSH to port '53' on the remote DNS server (possibly with your SSH server acting as forwarder).

share|improve this answer
1  
Doesn't /etc/resolv.conf get re-written by the system automatically, for typical setups? –  neon_overload Jun 8 '12 at 1:00
    
Yes, it does, thanks for reminding me! I'll edit the answer to reflect that. +1! –  izx Jun 8 '12 at 1:22
    
Thank you for this. It has confirmed my thoughts on how this SSH-SOCKS proxy works. However, could you please elaborate exactly on how to the global way to tunnel DNS lookups over the proxy? (say I were to use 8.8.8.8 as my primary DNS server) I'm using opera for my browser and I'm not entirely sure if opera does the same thing like firefox and chrome when using a SOCKS5 proxy. –  Rey Leonard Amorato Jun 8 '12 at 12:10

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.