If your intent is to hide what you're doing from your LAN/ISP, there is a snag with Firefox. It will leak DNS requests locally unless you go to about:config and set "network.proxy.socks_remote_dns" to "true"

Yes, its a useful trick I often use. However, does anyone know if Chromium or Opera can do the same DNS request tunnelling? (Firefox+Linux is sluggish for me.)

I'm pretty sure Chrome, at least, doesn't support SOCKS yet at all.

I was trying to make a shell script just the other day that would set up a SSH SOCKS proxy to a remote box and launch a browser using it, but couldn't do it from the command line in either Firefox or Chrome (didn't try a custom profile). Furthermore, I couldn't get it working in Chrome at all (shame; Firefox is more sluggish, and Opera won't even start on my box).

Chrome (under both Windows & Linux - not sure about OS X) can use SOCKS - I use it regularly.

I'm unsure how to make it do remote DNS look-ups though.

Opera cannot do SOCKS.

One problem with Chrome is that its proxy config interface really is just interfacing with the GNOME desktop-wide proxy settings. So it's impossible to have Chrome use multiple proxies or to only have one instance of Chrome use a proxy, but another instance not -- even if both instances have completely separate user data directories -- and all proxy changes are instantaneous across all Chrome instances. (At least for Chromium 5.0.391.0 on Linux)

Try the proxy switchy extension - it should at least make it very fast to switch proxies.

Yeah, I got it to work now, thanks to google. Hadn't realized that it needs a) a new session and b) an environment variable set.

  function remotebrowse() {
    export SOCKS_SERVER=localhost:5432
    ssh -fNTD 5432 remote
    google-chrome --user-data-dir=/tmp/chrome $1 &
  }

I get some error messages, but it seems to work.

Really? I just the the GUI to set it (Ubuntu 9.10, 10.04, Windows XP, Vista & 7)

I don't have a GUI (Xubuntu 9.10), and I don't want to set it permanently. Just so I can get at some ip-restricted content from home.

Chrome on OS X can use SOCKS, but not explicitly for Chrome, since the operating system manages the connections under System Preferences > Network > Advanced > Proxies.

Using this method, will OS/X use the remote machine for DNS lookups or my ISP?

Even better, run the SSH server on port 443. Then you'll be able to tunnel though most corporate firewalls.

Even better: Use SSLH[1], so you can still have an HTTPS server, but also connect to ssh on port 443. Set it up myself and my boss still doesn't know.. :)

[1]: http://www.rutschle.net/tech/sslh.shtml

i do it every day, works out easier for the IT dept then configing the network for ppl like me... but if you are not on good terms with the IT dept its a good way to lose your job, tread carefully.

I'm not sure what you're aiming at here. Could someone explain in plain English what's happening here and why this might be useful? Thanks.

As others have mentioned, it allows you to use a remote box as a SOCKS proxy, so your browsing traffic originates from there and is encrypted on the local network.

This is useful when the local network is untrusted, or to bypass things like url blocklists or IP filtering.

The arguments are as follows:

ssh -C2qTnN -D 8080 [email protected]

C2: request compression, at level 2 (1 is least)

q: quite mode

T: Disable pseudo-tty allocation. I don't know why you would want this. I suspect since you are only using it for a proxy you don't really need a tty, but seems a little unnecessary to me.

n: redirect stdin from /dev/null. Again, not sure why this is needed, but I suspect it is related to the "T" option.

N: Do not execute a remote command. You are only using port forwarding so no commands are needed.

-D 8080: the local port to forward

[email protected]: Username/host of remote machine.

This is a pretty optimized example. The simplest working version is just ssh -D 8080 [email protected]. Personally, I'd use the -C2 argument as well, but leave the rest out.

According to my manpage, C is for compression and 2 is for SSH2. You'd need to use -o to set the compression level, and then you'd probably also want to make sure compression actually helps (manpage warns against it).

Similarly, -n is described as necessary for backgrounding the process, if you want to. I can't find a reason to use -T, unless you intend to send binary data over the pipe.

Thanks. so it's for a private proxy.

Basically, you are sending and receiving all of your web traffic through an encrypted connection to a remote computer.

A typical use for this is when you are connected to a foreign network like a hotel. If you don't route your http traffic over ssh, there is a risk of having your traffic sniffed and/or recorded.

You could also (theoretically, haven't tested it all):

- watch Hulu, when you're not in the US

- use Spotify when you are in the US (and you use a UK box for example)

- bypass your university firewall

- in general secure your connection in case you are using an open network

Actually I'm pretty sure the Adobe Flash plugin will ignore your proxy settings, so it will only work with actual web sites.

This isn't true - I use a proxy tunnel frequently, and Flash works fine.

Flash works but it uses the default system connection and not your browsers proxy connection. So in cases of site that have IP based restriction, flash based sites will still see your original IP

and how do you know about this ? I use the very same trick with youtube and many other flash based sites. And flash ALWAYS use the browser's settings (at least in opera and firefox) both in Windows and Ubuntu

Launch your browser using tsocks.

ssh tunnels work great for hulu and netflix when travelling abroad. Or so I've heard :)