Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm using Ubuntu 10.04, and starting a SOCKS proxy with 'ssh -D', and setting Ubuntu to use it with "System -> Preferences -> Network Proxy". Firefox uses the proxy, and the proxy's IP appears when I visit a site like http://www.whatismyip.com/.

My question is, is Firefox resolving DNS requests through this proxy? Is my web-browsing truly secure? (That is, until I exit the other end of the proxy. I know it's insecure after that.) (And I've verified the keys, I'm not being man-in-the-middled) (And--screw it. You know what I mean. Is it resolving DNS requests through the proxy?)

I don't know how I would go about verifying such a thing for myself. Using additional hardware such as another debugging proxy is not an option.

If Firefox isn't resolving my DNS requests through the SOCKS proxy, how do I go about fixing it?

share|improve this question
    
Use FoxyProxy. It's the best add-on ever –  D'Arvit Jun 26 '10 at 14:26

3 Answers 3

up vote 7 down vote accepted

Firefox has an about:config setting that controls whether or not DNS gets routed through your proxy. It's off by default. I forget the setting name, but if you use the filter, it should not be hard to find.

share|improve this answer
    
I found "network.proxy.socks_remote_dns", I presume that's it. However, when I toggled it from 'false' to 'true' and restarted Firefox, it didn't help! I can still see my DNS requests with Wireshark! –  Maarx Jun 25 '10 at 23:23
1  
I've discovered something interesting! In Firefox, under "Edit -> Preferences -> Advanced -> Network -> [Settings]", if you choose "(o) Use system proxy settings", then Firefox doesn't respect the value of "network.proxy.socks_remote_dns"!! If, however, you change it to "(o) Manual Proxy Configuration:" and repeat the same configuration that Ubuntu already has, then the "network.proxy.socks_remote_dns" option suddenly starts taking effect! This behavior seems very unintuitive. –  Maarx Jun 26 '10 at 1:23
    
Interesting. Thanks for the follow up –  Daenyth Jun 26 '10 at 10:33

[Edit: tsocks doesn't work for that, sorry. It has a compile-time option to force dns requests to use TCP, but that's not very elegant.]

proxychains intercepts getaddrinfo, that should work better.

In ./proxychains.conf, ~/.proxychains/proxychains.conf or /etc/proxychains.conf:

strict_chain
proxy_dns
tcp_read_time_out 15000
tcp_connect_time_out 8000
[ProxyList]
socks5  127.0.0.1 <your ssh -D port>
share|improve this answer
    
Thanks, Tobu! However, it doesn't seem to be working for me. I can still see my DNS traffic in Wireshark. –  Maarx Jun 26 '10 at 0:52
    
Your file wasn't a complete path. I assumed you meant "~/tsocks-ssh.conf". Did I get it right? –  Maarx Jun 26 '10 at 0:52
    
Aye, edited. [15chars] –  Tobu Jun 26 '10 at 8:26

You can verify that all your traffic is going through the SSH proxy by viewing the packets coming from your computer. This can be done by putting your NIC or wireless card into Permiscuous Mode and using a program like TCPDump or Wireshark(I recommend wireshark).

Using these programs you can see the network traffic and filter for a specific protocol of packets such as DNS. If you filter for DNS while the proxy is on and receive any packets (labeled as DNS) then at least some DNS requests aren't going through the proxy. The reason for this is because if they are going through SSH the only traffic you will see will be SSH.

There's a few things you need to watch out for, some plugins such may access the internet without using the proxy setting and can leak information. Firefox has a host of great addons which help make sure that everything goes through the proxy, check those out.

Good luck!

share|improve this answer
    
Thanks, Daisetsu! I installed Wireshark with "sudo apt-get install wireshark", enabled promiscuious mode with "sudo ifconfig eth0 -promisc", and started Wireshark with "sudo wireshark". I clearly see my DNS traffic not through the proxy! Time to fix it. –  Maarx Jun 25 '10 at 23:21
    
Try checking out TOR and look at which programs they have bundled with the proxy, they specificly are able to handle DNS requests through the proxy. –  Daisetsu Jun 27 '10 at 22:02

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.