0

I want to route all traffic for specific applications (for example Firefox supports SOCKS) through VPN. My VPN service provider offers configuration settings (SOCKS host, port) for SOCKS5 protocol. If I have understood correctly, SOCKS5 "provides authentication so only authorized users may access a server", in this case my VPN account, and is mandatory for this purpose.

Is it obligatory to also use a related DNS server (this VPN service has own DNS server, but performance may not be high) or will this configuration work with any DNS address? Is my internet connection dropped when the VPN connection goes down, but the DNS server is still accessible? How about vice-versa?

1

Web browsing is based on 2 major protocols: DNS and HTTP(S).

  • DNS is used to translate a domain name (i.e. superuser.com) into an IP address (i.e. 123.45.67.89).
  • HTTP actually transports the web pages & other data.

When you connect to https://superuser.com/, you computer will first ask the DNS server what is the IP of superuser.com. Let's assume it answers 123.45.67.89. Your computer will then ask 123.45.67.89 for the web page located at https://superuser.com/.

The thing is, 123.45.67.89 doesn't know which DNS you contacted, or if you contacted one at all.


When you use a SOCKS proxy, everytime your computer will want to talk with a server, it will first ask the SOCKS server to relay the message. Mr. SOCKS will first ask the DNS for the IP of superuser.com, and then it will ask 123.45.67.89 for the page at https://superuser.com/.

The thing is, most of the time in home configuration, the default DNS is your Internet box, which uses its local IP. That means your SOCKS proxy (which is out of your local network) will not be able to contact it. You need to change your DNS for an external one, but you don't need to specifically use the one provided by your SOCKS provider (you can use 8.8.8.8 and 8.8.4.4which are free DNSs provided by Google).


Now the fact that the SOCKS server relays your traffic obviously means that if the SOCKS is down, you can't access the Internet unless you disable the proxy settings.

One last thing: you may have noticed I never used "VPN" in this answer. That is because SOCKS is not a VPN protocol.

  • Is using SOCKS5 mandatory? – user598527 Jul 4 '17 at 14:22
  • 1
    Not necessarily. That depends on your service provider for SOCKS proxying. If they tell you to use SOCKS5, you will have to do it, because they expect incoming SOCKS requests to use SOCKS5. Actually SOCKS5 offers more features and security, so it's better anyway. – Nathan.Eilisha Shiraini Jul 4 '17 at 16:55
0

I can not comment, so I answer here.

As Nathan correctly told before, SOCKS and VPN are different things. Both may or may not have their own authentication (at least from SOCKS5). The first one is used to proxy Layer 7 protocols (eg. the software protocol) while VPNs are designed to connect two points with encrypted virtual network cable (e.g. they are tunneling the "network").

You may have both. You can use http(s) over socks5 over vpn. It's not uncommon among anonymity services.

The DNS service which is required to translate the human readable names to IP numbers, again may or may not tunneled over VPN or SOCKS. Most simple VPN config will tunnel everything over the VPN, that way also the DNS traffic. Whether your DNS querys go over the SOCKS or not is client dependent. For example, you can tell firefox to use dns over socks by setting network.proxy.socks_remote_dns to true under about:config.

If you don't pass DNS resolves over socks, you can use any resolver you want, including your box resolver.

If you are using this setup to achieve anonymity (for which I suggest you to add TOR to the setup) you may not want to let DNS queries to go at the standard way, since there is a slight chance that you can be traced by these packages (the site names you met).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.