11

Last year I was working in China for a few months. I never bothered setting up a real VPN, but just created a SSH tunnel, and changed my browsers proxy settings to connect through it.

Everything worked great (except flash of course) but that was fine.

However, now I'm back in China but I'm having problems with this approach. I do the same thing as last time, and according to https://ipcheckit.com/ my IP address is indeed the IP of my (private) server in the US, and I'm logging in to my server using a fingerprint I created long before going to China so no MITM should be possible. Furthermore the certificate from ipcheckit.com is from GeoTrust - so everything should be OK

However, I still can't access sites which are blocked in China. Any idea how this could be possible?

5
  • 10
    DNS might not be properly sent through the tunnel, try checking for unencrypted packets with Wireshark when browsing.
    – Eroen
    Commented Sep 28, 2012 at 6:50
  • Thats a good point. Thank you. I'll look into it
    – Martin
    Commented Sep 28, 2012 at 6:51
  • Yup, it was a DNS problem. Thank you very much
    – Martin
    Commented Sep 28, 2012 at 6:53
  • superuser.com/questions/103593/…
    – James T
    Commented Sep 28, 2012 at 9:36
  • 5
    @Eroen - Put your comment in an answer so that Martin can accept it.
    – Nifle
    Commented Sep 28, 2012 at 11:44

4 Answers 4

2

If you use linux or osx, you could try using sshuttle to create your ssh tunnel. That will make sure all the packets are being tunnelled.

https://github.com/apenwarr/sshuttle

./sshuttle -r username@sshserver 0/0 -vv

Additionally use a public dns server like Google's or OpenDNS

Also if you'd like to proxy your DNS requests, the command would be.

./sshuttle --dns -vvr username@sshserver 0/0

Sshuttle has worked for me wonderfully over the past 2 years and I can access everythings thats blocked by vietnamese ISPs.

Only downside is, it supports only password based authentication (AFAIK).

1
  • Nowadays, key authentication is also supported Commented Jun 12 at 2:07
1

Here's how you tunnel everything over sshuttle including DNS using public-key authentication.

sshuttle --dns -vr <remote username>@<remote IP address> 0/0 --ssh-cmd 'ssh -i <path to private key>'
1

When using SSH proxying to bypass websites that are blocked by DNS filtering, the DNS requests might not go through the proxy, causing a DNS leak and making the DNS requests go to the censoring DNS server. To check if there are leaks, go to https://ipleak.net/.

To fix the problem when using Firefox's proxy settings, make sure to check "Proxy DNS when using SOCKS v5".

If you want all programs to use the proxied DNS on Windows, it might be a little bit harder. This SO answer suggests running your own DNS server that forwards your DNS requests through a proxy. If anyone has an easier method, please let me know, and I will update this answer.

I used the system proxy settings on macOS, and there seem to be no DNS leaks there.

0

Try using TOR over your ssh tunnel use your ssh tunnel under proxy settings in TOR

1
  • Why would he want to do that? That'll just make everything REALLY slow. And he probably doesn't need the anonymity, just a way to get around the chinawall. Commented Nov 23, 2013 at 11:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .