How can I make sure all my Mac's TCP traffic goes through a SOCKS5 proxy?

Question

I have a SOCKS proxy with a port.

How can I make my MAC use it? What settings do I change under network settings?

Answer 1

Why isn't system preferences -> network -> (Select a network on the left side of the window and choose Advanced in the bottom right) -> Proxies (tab at the top) working for you?

Answer 2

If you can set yourself an SSH server, then the free sshuttle can tunnel all TCP traffic through the connection, doing all the firewall work for you.

To forward all TCP traffic and DNS requests to a remote SSH server, the command is simple enough :

sshuttle --dns -vr ssh_server 0/0

Besides TCP and DNS, sshuttle does not forward other requests such as UDP, ICMP, ping etc.

For more information and examples see the article Using Sshuttle in Daily Work.

Answer 3

While setting the system wide proxy settings is a good start, you may also want to look into using iptables to ensure that all traffic is going through the proxy. Some applications do not use system wide configuration settings (Firefox among them), and thus it's imperative that you tailor your rules not to allow direct connections and only to route traffic through the proxy.

EDIT: While I personally use iptables rules to manage potential "leakage" from my VPN, I was actually originally mistaken to think iptables could work with a socks proxy directly. You'll need something like tun2socks in order to make a virtual tunnel interface (such as vpn's use).

Following that, you can set up an iptables script similar to the following:

#!/bin/bash
if [[ $EUID -ne 0 ]]; then
    echo "This script must be run as root" 1>&2
    exit 1
fi

# name of primary network interface (before tunnel)
PRIMARY=eth0

# gateway ip address (before tunnel - adsl router ip address)
# automatically determine the ip from the default route
GATEWAY=`route -n | grep $PRIMARY | egrep "^0\.0\.0\.0" | tr -s " " | cut -d" " -f2`

# provided by tun2socks: interface name
TUNNEL=tun0

# If you'd like, putting the tun2socks command here is a good idea.  It may or may not be necessary to do so, but either way is more convenient than running the two commands separately.

# iptables rules - important!

LOCAL_NET=192.168.0.0/16
#LOCAL_NET=$GATEWAY

# Flush all previous filter rules, you might not want to include this line if you already have other rules setup
iptables -t filter --flush

iptables -t filter -X MYVPN
iptables -t filter -N MYVPN

# Add local routes to routing table
route add -net 192.168.1.0 netmask 255.255.255.0 dev eth0
route add -host 23.21.163.237 dev eth0 gw 192.168.1.1

# Add ssh routes to routing table
ip route add table 128 to 192.168.1.0/24 dev eth0
ip route add table 128 default via 192.168.1.1

# Exceptions for local traffic & vpn server
iptables -t filter -A MYVPN -o lo -j RETURN
iptables -t filter -A MYVPN -o ${TUNNEL} -j RETURN
iptables -t filter -A MYVPN --dst 127.0.0.1 -j RETURN
iptables -t filter -A MYVPN --dst $LOCAL_NET -j RETURN
iptables -t filter -A MYVPN --dst ${SERVER} -j RETURN
iptables -t filter -A MYVPN --dst ${VPN_SERVER} -j RETURN

# Add extra local nets here as necessary

iptables -t filter -A MYVPN -j DROP

# MYVPN traffic leaving this host:
iptables -t filter -A OUTPUT -p tcp --syn -j MYVPN
iptables -t filter -A OUTPUT -p icmp -j MYVPN
iptables -t filter -A OUTPUT -p udp -j MYVPN

Naturally you'll want to make this script reflects your particular network (ie, if you're using something like a 192.168.0.0/24 subnet, adjust accordingly). Also, it is very tightly based on a script I use with a VPN, hence, all the mentions MYVPN or VPN -- while you're not using a VPN, tun2socks effectively behaves as if you are, so everything should work the same.

And special thanks to this answer over at Unix.SE for steering me in the right direction to answer this one.

EDIT again: So, looks like OS X actually would be doing this with ipfw rather than iptables (sorry, I'm mostly a linux person, and thought OS X had iptables available). There are equivalencies such that the script can be adapted, some of which are pointed out here. man ipfw should set you straight on the syntax. I'll leave the original iptables script up as a template so you can see what is going on conceptually. WaterRoof appears like it may help make using ipfw a little more user friendly; other front ends may be available as well.

Answer 4

There are a number of solutions available. None of them is as simple as changing some settings: the reason is that this defeats the whole goal of proxying, which is to route some specific application through a different route (for purposes of stealth, security, identity protection...) while leaving you access to the (supposedly faster) local route.

Some are to be discarded because of your requirements, but let me just mention them for the sake of completeness: a VPN, an SSH tunnel, use of pfctl (the packet filter and NAT control interface). Also, Tor, though certainly not designed for the use you have in mind, allows you to route all traffic through their proxies.

All of these applications are free, and require at most some ingenuity to get them going. On the other hand, there are for-pay applications, where most of the work has been done by someone else, though at a price.

Proxycap

enables you to redirect your computer's network connections through proxy servers. You can tell ProxyCap which applications will connect to the Internet through a proxy and under what circumstances. This is done through a user friendly interface, without the need to reconfigure any of your Internet clients

Alternatively, there is Proxifier for Mac (careful: supports only out to 10.8). which

allows network applications that do not support working through proxy servers to operate through a SOCKS or HTTPS proxy and chains.

Answer 5

The only free solution I found is tun2socks which requires you to setup your own routes, I followed the official docs https://github.com/xjasonlyu/tun2socks/wiki/Examples

But had to exclude the entry ips such as the dns from it, I did that by adding the ips I wanted excluded on the default gateway.

Got it working very well on MacOS.

Answer 6

Go to Preferences->Network See if there is a lock on that, click on it and give your system administrator account password. Then Advanced->Proxies->Check on Socks Proxy. Give your proxy settings.