13

I have a SOCKS proxy with a port.

How can I make my MAC use it? What settings do I change under network settings?

3

Why isn't system preferences -> network -> (Select a network on the left side of the window and choose Advanced in the bottom right) -> Proxies (tab at the top) working for you?

enter image description here

| improve this answer | |
  • 9
    That does not work for all apps. Skype, Chrome and others seem to bypass these settings - at least on 10.10... – Ingwie Phoenix Dec 8 '14 at 8:54
  • What you said is true. It's even mentioned in other comments. The author made it clear they wanted simple, so I started with simple by asking what about the answer I posted wouldn't work for them. Obviously it worked for them because they selected it. Security is not always about the 100% answer. Most of the time it is about risk reduction. – Everett Dec 8 '14 at 18:25
  • 1
    Terminal cannot adopt system network socks5 proxy settings, but app wide will be ok. – E_Jovi Nov 9 '17 at 9:52
6

If you can set yourself an SSH server, then the free sshuttle can tunnel all TCP traffic through the connection, doing all the firewall work for you.

To forward all TCP traffic and DNS requests to a remote SSH server, the command is simple enough :

sshuttle --dns -vr ssh_server 0/0

Besides TCP and DNS, sshuttle does not forward other requests such as UDP, ICMP, ping etc.

For more information and examples see the article Using Sshuttle in Daily Work.

| improve this answer | |
  • While the questioner doesn't have an SSH server to use for the purpose, I'd like to at least thank you for reminding me of this great tool and functionality it brings. The simplicity in that syntax is fantastic, and being able to handle either iptables or ipfw on the backend is really a feature worth praising from the rooftops. – 0xDAFACADE Sep 4 '14 at 20:04
  • This does not redirect all TCP traffic, for example if you have VMWare running it bypasses this. – Soheil Dec 3 '15 at 19:43
5

While setting the system wide proxy settings is a good start, you may also want to look into using iptables to ensure that all traffic is going through the proxy. Some applications do not use system wide configuration settings (Firefox among them), and thus it's imperative that you tailor your rules not to allow direct connections and only to route traffic through the proxy.

EDIT: While I personally use iptables rules to manage potential "leakage" from my VPN, I was actually originally mistaken to think iptables could work with a socks proxy directly. You'll need something like tun2socks in order to make a virtual tunnel interface (such as vpn's use).

Following that, you can set up an iptables script similar to the following:

#!/bin/bash
if [[ $EUID -ne 0 ]]; then
    echo "This script must be run as root" 1>&2
    exit 1
fi

# name of primary network interface (before tunnel)
PRIMARY=eth0

# gateway ip address (before tunnel - adsl router ip address)
# automatically determine the ip from the default route
GATEWAY=`route -n | grep $PRIMARY | egrep "^0\.0\.0\.0" | tr -s " " | cut -d" " -f2`

# provided by tun2socks: interface name
TUNNEL=tun0

# If you'd like, putting the tun2socks command here is a good idea.  It may or may not be necessary to do so, but either way is more convenient than running the two commands separately.

# iptables rules - important!

LOCAL_NET=192.168.0.0/16
#LOCAL_NET=$GATEWAY

# Flush all previous filter rules, you might not want to include this line if you already have other rules setup
iptables -t filter --flush

iptables -t filter -X MYVPN
iptables -t filter -N MYVPN

# Add local routes to routing table
route add -net 192.168.1.0 netmask 255.255.255.0 dev eth0
route add -host 23.21.163.237 dev eth0 gw 192.168.1.1

# Add ssh routes to routing table
ip route add table 128 to 192.168.1.0/24 dev eth0
ip route add table 128 default via 192.168.1.1

# Exceptions for local traffic & vpn server
iptables -t filter -A MYVPN -o lo -j RETURN
iptables -t filter -A MYVPN -o ${TUNNEL} -j RETURN
iptables -t filter -A MYVPN --dst 127.0.0.1 -j RETURN
iptables -t filter -A MYVPN --dst $LOCAL_NET -j RETURN
iptables -t filter -A MYVPN --dst ${SERVER} -j RETURN
iptables -t filter -A MYVPN --dst ${VPN_SERVER} -j RETURN

# Add extra local nets here as necessary

iptables -t filter -A MYVPN -j DROP

# MYVPN traffic leaving this host:
iptables -t filter -A OUTPUT -p tcp --syn -j MYVPN
iptables -t filter -A OUTPUT -p icmp -j MYVPN
iptables -t filter -A OUTPUT -p udp -j MYVPN

Naturally you'll want to make this script reflects your particular network (ie, if you're using something like a 192.168.0.0/24 subnet, adjust accordingly). Also, it is very tightly based on a script I use with a VPN, hence, all the mentions MYVPN or VPN -- while you're not using a VPN, tun2socks effectively behaves as if you are, so everything should work the same.

And special thanks to this answer over at Unix.SE for steering me in the right direction to answer this one.

EDIT again: So, looks like OS X actually would be doing this with ipfw rather than iptables (sorry, I'm mostly a linux person, and thought OS X had iptables available). There are equivalencies such that the script can be adapted, some of which are pointed out here. man ipfw should set you straight on the syntax. I'll leave the original iptables script up as a template so you can see what is going on conceptually. WaterRoof appears like it may help make using ipfw a little more user friendly; other front ends may be available as well.

| improve this answer | |
  • I don't want to use iptables because it's too complicated. Tun2socks looks like I need SSH and a server. I just have an IP and a port...How can I just use the IP and port? – Alex Sep 4 '14 at 0:01
  • tun2socks doesn't require SSH and a server; the example on their site is for using SSH to create the SOCKS proxy in the first place. If you already have a SOCKS proxy, it's entirely unnecessary. And yes, iptables was a wrong way on my part. OS X, being based on BSD, uses ipfw rather than iptables, which is for the Linux kernel. As for it being complicated, you may be able to find a frontend that'll set it up for you in an easier to use manner, but I've no experience on this matter. It being complicated at a low level anyway has a lot to do with why it is so capable for the job. – 0xDAFACADE Sep 4 '14 at 1:11
  • I've added a frontend for you to use to the answer if it helps make navigating ipfw easier. – 0xDAFACADE Sep 4 '14 at 1:19
0

There are a number of solutions available. None of them is as simple as changing some settings: the reason is that this defeats the whole goal of proxying, which is to route some specific application through a different route (for purposes of stealth, security, identity protection...) while leaving you access to the (supposedly faster) local route.

Some are to be discarded because of your requirements, but let me just mention them for the sake of completeness: a VPN, an SSH tunnel, use of pfctl (the packet filter and NAT control interface). Also, Tor, though certainly not designed for the use you have in mind, allows you to route all traffic through their proxies.

All of these applications are free, and require at most some ingenuity to get them going. On the other hand, there are for-pay applications, where most of the work has been done by someone else, though at a price.

Proxycap

enables you to redirect your computer's network connections through proxy servers. You can tell ProxyCap which applications will connect to the Internet through a proxy and under what circumstances. This is done through a user friendly interface, without the need to reconfigure any of your Internet clients

Alternatively, there is Proxifier for Mac (careful: supports only out to 10.8). which

allows network applications that do not support working through proxy servers to operate through a SOCKS or HTTPS proxy and chains.

| improve this answer | |
0

Go to Preferences->Network See if there is a lock on that, click on it and give your system administrator account password. Then Advanced->Proxies->Check on Socks Proxy. Give your proxy settings.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.