6

I'm using Ubuntu 10.04, and starting a SOCKS proxy with 'ssh -D', and setting Ubuntu to use it with "System -> Preferences -> Network Proxy". Firefox uses the proxy, and the proxy's IP appears when I visit a site like http://www.whatismyip.com/.

My question is, is Firefox resolving DNS requests through this proxy? Is my web-browsing truly secure? (That is, until I exit the other end of the proxy. I know it's insecure after that.) (And I've verified the keys, I'm not being man-in-the-middled) (And--screw it. You know what I mean. Is it resolving DNS requests through the proxy?)

I don't know how I would go about verifying such a thing for myself. Using additional hardware such as another debugging proxy is not an option.

If Firefox isn't resolving my DNS requests through the SOCKS proxy, how do I go about fixing it?

Improve this question
1
  • Use FoxyProxy. It's the best add-on ever
    – D'Arvit
    Jun 26, 2010 at 14:26

4 Answers 4

Reset to default
8

Firefox has an about:config setting that controls whether or not DNS gets routed through your proxy. It's off by default. I forget the setting name, but if you use the filter, it should not be hard to find.

Improve this answer
3
  • I found "network.proxy.socks_remote_dns", I presume that's it. However, when I toggled it from 'false' to 'true' and restarted Firefox, it didn't help! I can still see my DNS requests with Wireshark!
    – Maarx
    Jun 25, 2010 at 23:23
  • 3
    I've discovered something interesting! In Firefox, under "Edit -> Preferences -> Advanced -> Network -> [Settings]", if you choose "(o) Use system proxy settings", then Firefox doesn't respect the value of "network.proxy.socks_remote_dns"!! If, however, you change it to "(o) Manual Proxy Configuration:" and repeat the same configuration that Ubuntu already has, then the "network.proxy.socks_remote_dns" option suddenly starts taking effect! This behavior seems very unintuitive.
    – Maarx
    Jun 26, 2010 at 1:23
  • @Maarx, I've noticed that when HTTP protocol is used then DNS requests are not sent via Proxy, for HTTPS it works fine. How can this be the case?
    – Eugene D. Gubenkov
    Sep 19, 2018 at 18:16
2

You can verify that all your traffic is going through the SSH proxy by viewing the packets coming from your computer. This can be done by putting your NIC or wireless card into Permiscuous Mode and using a program like TCPDump or Wireshark(I recommend wireshark).

Using these programs you can see the network traffic and filter for a specific protocol of packets such as DNS. If you filter for DNS while the proxy is on and receive any packets (labeled as DNS) then at least some DNS requests aren't going through the proxy. The reason for this is because if they are going through SSH the only traffic you will see will be SSH.

There's a few things you need to watch out for, some plugins such may access the internet without using the proxy setting and can leak information. Firefox has a host of great addons which help make sure that everything goes through the proxy, check those out.

Good luck!

Improve this answer
2
  • Thanks, Daisetsu! I installed Wireshark with "sudo apt-get install wireshark", enabled promiscuious mode with "sudo ifconfig eth0 -promisc", and started Wireshark with "sudo wireshark". I clearly see my DNS traffic not through the proxy! Time to fix it.
    – Maarx
    Jun 25, 2010 at 23:21
  • Try checking out TOR and look at which programs they have bundled with the proxy, they specificly are able to handle DNS requests through the proxy.
    – Daisetsu
    Jun 27, 2010 at 22:02
1

[Edit: tsocks doesn't work for that, sorry. It has a compile-time option to force dns requests to use TCP, but that's not very elegant.]

proxychains intercepts getaddrinfo, that should work better.

In ./proxychains.conf, ~/.proxychains/proxychains.conf or /etc/proxychains.conf:

strict_chain
proxy_dns
tcp_read_time_out 15000
tcp_connect_time_out 8000
[ProxyList]
socks5  127.0.0.1 <your ssh -D port>
Improve this answer
3
  • Thanks, Tobu! However, it doesn't seem to be working for me. I can still see my DNS traffic in Wireshark.
    – Maarx
    Jun 26, 2010 at 0:52
  • Your file wasn't a complete path. I assumed you meant "~/tsocks-ssh.conf". Did I get it right?
    – Maarx
    Jun 26, 2010 at 0:52
  • Aye, edited. [15chars]
    – Tobu
    Jun 26, 2010 at 8:26
0

Firefox now has a visual way to enable remote DNS instead of depending on the system DNS. It's a check box next to the SOCKS v5 proxy option, called Remote DNS.

Image showing the Remote DNS check box

Improve this answer
1
  • You should edit this question to include the same content as for your other answer rather than simply link to it. Link-only answers are not useful by themselves; answers should be as self-contained as possible.
    – Anthony Geoghegan
    May 3, 2016 at 10:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .