4

I've been using an ssh tunnel for browsing, reading that doing so would encrypt the connection to the internet. However, i have no idea as to what kind of protection that the ssh tunnel really provide.

Does it just protect my connection from network/packet sniffers or does it block out my ISP as well?

EDIT: Also, must i use a remote server to ssh to or can i just tunnel to localhost and still have the same effects? e.g the command i use now is ssh localhost -p 22 -ND 8080

Improve this question
4
  • I don't have an answer to your question as such, but have a look at the Tor Project for anonymous browsing. torproject.org
    – Clive van Hilten
    Jun 7, 2012 at 20:33
  • Based on the website; Using Tor protects you against a common form of Internet surveillance known as "traffic analysis." is an ssh tunnel limited to that?
    – Rey Leonard Amorato
    Jun 7, 2012 at 20:38
  • Please remember to accept/upvote the best answer to your question (tick/check mark on the left). This way, the question is marked as "answered" and future readers can refer to it knowing the solution works. Thank you...:)
    – ish
    Jun 16, 2012 at 10:54
  • Yes, thank you for reminding me. I still have some unanswered questions (above edit and comment on your answer). If you could perhaps shed some light on those, that'd be great.
    – Rey Leonard Amorato
    Jun 16, 2012 at 16:26

1 Answer 1

Reset to default
3

Does it just protect my connection from network/packet sniffers or does it block out my ISP as well?

It also blocks out your ISP completely if and only if DNS lookups are also tunneled, and not done in the clear or worse, from the ISP's own DNS servers.

What I mean is, suppose you want to visit www.wikileaks.org over your SSH-SOCKS proxy. What your browser will almost certainly do is use regular DNS to resolve www.wikileaks.org to an IP, but then tunnel all traffic to that IP over the proxy. So your ISP (or a sniffer) could tell that you wanted to visit wikileaks.org, but not what page you wanted to see (or saw).

The solution is to also tunnel DNS lookups over the proxy.

  • For Firefox, it's as simple as typing about:config and changing the network.proxy.socks_remote_dns setting to true.

  • Chromium (or Chrome) will only do this if you are using a Socks 5 proxy!

  • The global way to do this is to set your DNS using NetworkManager to localhost, where you forward port '53' over SSH to port '53' on the remote DNS server (possibly with your SSH server acting as forwarder).

Improve this answer
4
  • 1
    Doesn't /etc/resolv.conf get re-written by the system automatically, for typical setups?
    – thomasrutter
    Jun 8, 2012 at 1:00
  • Yes, it does, thanks for reminding me! I'll edit the answer to reflect that. +1!
    – ish
    Jun 8, 2012 at 1:22
  • 1
    Thank you for this. It has confirmed my thoughts on how this SSH-SOCKS proxy works. However, could you please elaborate exactly on how to the global way to tunnel DNS lookups over the proxy? (say I were to use 8.8.8.8 as my primary DNS server) I'm using opera for my browser and I'm not entirely sure if opera does the same thing like firefox and chrome when using a SOCKS5 proxy.
    – Rey Leonard Amorato
    Jun 8, 2012 at 12:10
  • Please @izx can you explain how to implement the global way, or give any reference of how to do it? thanks
    – surfealokesea
    Mar 15, 2017 at 7:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .