mirror of
https://github.com/darkk/redsocks.git
synced 2025-08-29 05:05:30 +00:00
Update README
This commit is contained in:
Leonid Evdokimov
parent
268c00eb29
commit
5df6a30e5f
203
README
203
README
@ -1,203 +0,0 @@
|
||||
This tool allows you to redirect any TCP connection to SOCKS or HTTPS
|
||||
proxy using your firewall, so redirection is system-wide.
|
||||
|
||||
Why is that useful? I can suggest following reasons:
|
||||
* you use tor[1] and don't want any TCP connection to leak.
|
||||
* you use DVB ISP and this ISP provides internet connectivity with some
|
||||
special daemon that may be also called "Internet accelerator" and this
|
||||
accelerator acts as proxy. Globax[2] is example of such an accelerator.
|
||||
|
||||
Linux/iptables, OpenBSD/pf and FreeBSD/ipfw are supported.
|
||||
Linux/iptables is well-tested, other implementations may have bugs,
|
||||
your bugreports are welcome.
|
||||
|
||||
Transocks[3] is alike project but it has noticable performance penality.
|
||||
|
||||
Transsocks_ev[4] is alike project too, but it has no HTTPS-proxy support
|
||||
and does not support authentication.
|
||||
|
||||
Several Android apps also use redsocks under-the-hood: ProxyDroid[5][6] and
|
||||
sshtunnel[7][8]. And that's over 100'000 downloads! Wow!
|
||||
|
||||
[1] http://www.torproject.org
|
||||
[2] http://www.globax.biz
|
||||
[3] http://transocks.sourceforge.net/
|
||||
[4] http://oss.tiggerswelt.net/transocks_ev/
|
||||
[5] http://code.google.com/p/proxydroid/
|
||||
[6] https://market.android.com/details?id=org.proxydroid
|
||||
[7] http://code.google.com/p/sshtunnel/
|
||||
[8] https://market.android.com/details?id=org.sshtunnel
|
||||
|
||||
|
||||
Another related issue is DNS over TCP. Redsocks includes `dnstc' that is fake
|
||||
and really dumb DNS server that returns "truncated answer" to every query via
|
||||
UDP. RFC-compliant resolver should repeat same query via TCP in this case - so
|
||||
the request can be redirected using usual redsocks facilities.
|
||||
|
||||
Known compliant resolvers are:
|
||||
* bind9 (server)
|
||||
* dig, nslookup (tools based on bind9 code)
|
||||
Known non-compliant resolvers are:
|
||||
* eglibc resolver fails without any attempt to send request via TCP
|
||||
* powerdns-recursor can't properly startup without UDP connectivity as it
|
||||
can't load root hints
|
||||
|
||||
On the other hand, DNS via TCP using bind9 may be painfully slow. If your bind9
|
||||
setup is really slow, you have at least two options: pdnsd[9] caching server
|
||||
can run in TCP-only mode, ttdnsd[10][11] has no cache but can be useful for same
|
||||
purpose.
|
||||
|
||||
[9] http://www.phys.uu.nl/~rombouts/pdnsd.html
|
||||
[10] http://www.mulliner.org/collin/ttdnsd.php
|
||||
[11] https://gitweb.torproject.org/ioerror/ttdnsd.git
|
||||
|
||||
|
||||
Features
|
||||
========
|
||||
|
||||
Redirect any TCP connection to SOCKS4, SOCKS5 or HTTPS (HTTP/CONNECT)
|
||||
proxy server.
|
||||
|
||||
Login/password authentication is supported for SOCKS5/HTTPS connections.
|
||||
SOCKS4 supports only username, password is ignored. for HTTPS, currently
|
||||
only Basic and Digest scheme is supported.
|
||||
|
||||
Redirect UDP packets via SOCKS5 proxy server. NB: UDP still goes via UDP, so
|
||||
you can't relay UDP via OpenSSH.
|
||||
|
||||
Sends "truncated reply" as an answer to UDP DNS queries.
|
||||
|
||||
Redirect any HTTP connection to proxy that does not support transparent
|
||||
proxying (e.g. old SQUID had broken `acl myport' for such connections).
|
||||
|
||||
|
||||
License
|
||||
=======
|
||||
|
||||
All source code is licensed under Apache 2.0 license.
|
||||
You can get a copy at http://www.apache.org/licenses/LICENSE-2.0.html
|
||||
|
||||
|
||||
Packages
|
||||
========
|
||||
* Archlinux: https://aur.archlinux.org/packages/redsocks-git
|
||||
* Debian: http://packages.debian.org/search?searchon=names&keywords=redsocks
|
||||
* Gentoo (pentoo overlay): https://code.google.com/p/pentoo/source/browse/portage/trunk/net-proxy/redsocks
|
||||
* Gentoo (theebuilds overlay): http://code.google.com/p/theebuilds/source/browse/trunk/net-misc/redsocks
|
||||
* Gentoo (zugaina overlay): http://gpo.zugaina.org/net-proxy/redsocks
|
||||
* Ubuntu: http://packages.ubuntu.com/search?searchon=names&keywords=redsocks
|
||||
|
||||
|
||||
Compilation
|
||||
===========
|
||||
|
||||
libevent-2.0.x[5] is required.
|
||||
|
||||
gcc and clang are supported right now, other compilers can be used
|
||||
but may require some code changes.
|
||||
|
||||
Compilation is as easy as running `make', there is no `./configure' magic.
|
||||
|
||||
GNU Make works, other implementations of make were not tested.
|
||||
|
||||
[5] http://libevent.org/ || http://www.monkey.org/~provos/libevent/
|
||||
|
||||
|
||||
Running
|
||||
=======
|
||||
|
||||
Program has following command-line options:
|
||||
-c sets proper path to config file ("./redsocks.conf" is default one)
|
||||
-t tests config file syntax
|
||||
-p set a file to write the getpid() into
|
||||
|
||||
Following signals are understood:
|
||||
SIGUSR1 dumps list of connected clients to log
|
||||
SIGTERM and SIGINT terminates daemon, all active connections are closed
|
||||
|
||||
You can see configuration file example in redsocks.conf.example
|
||||
|
||||
|
||||
iptables example
|
||||
================
|
||||
|
||||
You have to build iptables with connection tracking and REDIRECT target.
|
||||
|
||||
# Create new chain
|
||||
root# iptables -t nat -N REDSOCKS
|
||||
|
||||
# Ignore LANs and some other reserved addresses.
|
||||
# See http://en.wikipedia.org/wiki/Reserved_IP_addresses#Reserved_IPv4_addresses
|
||||
# and http://tools.ietf.org/html/rfc5735 for full list of reserved networks.
|
||||
root# iptables -t nat -A REDSOCKS -d 0.0.0.0/8 -j RETURN
|
||||
root# iptables -t nat -A REDSOCKS -d 10.0.0.0/8 -j RETURN
|
||||
root# iptables -t nat -A REDSOCKS -d 100.64.0.0/10 -j RETURN
|
||||
root# iptables -t nat -A REDSOCKS -d 127.0.0.0/8 -j RETURN
|
||||
root# iptables -t nat -A REDSOCKS -d 169.254.0.0/16 -j RETURN
|
||||
root# iptables -t nat -A REDSOCKS -d 172.16.0.0/12 -j RETURN
|
||||
root# iptables -t nat -A REDSOCKS -d 192.168.0.0/16 -j RETURN
|
||||
root# iptables -t nat -A REDSOCKS -d 198.18.0.0/15 -j RETURN
|
||||
root# iptables -t nat -A REDSOCKS -d 224.0.0.0/4 -j RETURN
|
||||
root# iptables -t nat -A REDSOCKS -d 240.0.0.0/4 -j RETURN
|
||||
|
||||
# Anything else should be redirected to port 12345
|
||||
root# iptables -t nat -A REDSOCKS -p tcp -j REDIRECT --to-ports 12345
|
||||
|
||||
# Any tcp connection made by `luser' should be redirected.
|
||||
root# iptables -t nat -A OUTPUT -p tcp -m owner --uid-owner luser -j REDSOCKS
|
||||
|
||||
# You can also control that in more precise way using `gid-owner` from
|
||||
# iptables.
|
||||
root# groupadd socksified
|
||||
root# usermod --append --groups socksified luser
|
||||
root# iptables -t nat -A OUTPUT -p tcp -m owner --gid-owner socksified -j REDSOCKS
|
||||
|
||||
# Now you can launch your specific application with GID `socksified` and it
|
||||
# will be... socksified. See following commands (numbers may vary).
|
||||
# Note: you may have to relogin to apply `usermod` changes.
|
||||
luser$ id
|
||||
uid=1000(luser) gid=1000(luser) groups=1000(luser),1001(socksified)
|
||||
luser$ sg socksified -c id
|
||||
uid=1000(luser) gid=1001(socksified) groups=1000(luser),1001(socksified)
|
||||
luser$ sg socksified -c "firefox"
|
||||
|
||||
# If you want to configure socksifying router, you should look at
|
||||
# doc/iptables-packet-flow.png, doc/iptables-packet-flow-ng.png and
|
||||
# https://en.wikipedia.org/wiki/File:Netfilter-packet-flow.svg
|
||||
# Note, you should have proper `local_ip' value to get external packets with
|
||||
# redsocks, default 127.0.0.1 will not go. See iptables(8) manpage regarding
|
||||
# REDIRECT target for details.
|
||||
# Depending on your network configuration iptables conf. may be as easy as:
|
||||
root# iptables -t nat -A PREROUTING --in-interface eth_int -p tcp -j REDSOCKS
|
||||
|
||||
Note about GID-based redirection
|
||||
========
|
||||
Keep in mind, that changed GID affects filesystem permissions, so if your
|
||||
application creates some files, the files will be created with luser:socksified
|
||||
owner/group. So, if you're not the only user in the group `socksified` and your
|
||||
umask allows to create group-readable files and your directory permissions, and
|
||||
so on, blah-blah, etc. THEN you may expose your files to another user.
|
||||
Ok, you have been warned.
|
||||
|
||||
Homepage
|
||||
========
|
||||
|
||||
http://darkk.net.ru/redsocks/
|
||||
|
||||
Mailing list: redsocks@librelist.com
|
||||
|
||||
Mailing list also has archives[1].
|
||||
|
||||
[1] http://librelist.com/browser/redsocks/
|
||||
|
||||
|
||||
TODO
|
||||
====
|
||||
|
||||
Test OpenBSD (pf) and FreeBSD (ipfw) and write setup examples for those
|
||||
firewall types.
|
||||
|
||||
|
||||
Author
|
||||
======
|
||||
This program was written by Leonid Evdokimov <leon@darkk.net.ru>
|
||||
240
README.html
240
README.html
@ -1,240 +0,0 @@
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
|
||||
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
|
||||
<link rel="stylesheet" type="text/css" href="../site.css" />
|
||||
<title>redsocks - transparent socks redirector</title>
|
||||
</head>
|
||||
<body>
|
||||
<!-- Intro -->
|
||||
<h1>redsocks - transparent socks redirector</h1>
|
||||
<div class="navi">
|
||||
<a href="../">darkk's homepage</a>
|
||||
<a href="http://github.com/darkk/redsocks/tree/master">download source code</a>
|
||||
</div>
|
||||
|
||||
<hr/>
|
||||
|
||||
<p>This tool allows you to redirect any TCP connection to SOCKS or HTTPS
|
||||
proxy using your firewall, so redirection is system-wide.</p>
|
||||
|
||||
<p>Why is that useful? I can suggest following reasons:</p>
|
||||
<ul>
|
||||
<li>you use <a href="http://www.torproject.org">tor</a> and don't want any TCP connection to leak</li>
|
||||
<li>you use DVB ISP and this ISP provides internet connectivity with some
|
||||
special daemon that may be also called "Internet accelerator" and this
|
||||
accelerator acts as proxy. <a href="http://www.globax.biz">Globax</a> is example of such an accelerator</li>
|
||||
</ul>
|
||||
|
||||
<p>Linux/iptables, OpenBSD/pf and FreeBSD/ipfw are supported.
|
||||
Linux/iptables is well-tested, other implementations may have bugs,
|
||||
your bugreports are welcome.</p>
|
||||
|
||||
<p><a href="http://transocks.sourceforge.net/">Transocks</a> is alike project but it has noticable performance penality.</p>
|
||||
|
||||
<p><a href="http://oss.tiggerswelt.net/transocks_ev/">Transsocks_ev</a> is alike project too, but it has no HTTPS-proxy support
|
||||
and does not support authentication.</p>
|
||||
|
||||
<p>Several Andoird apps also use redsocks under-the-hood: <a href="http://code.google.com/p/proxydroid/">ProxyDroid</a> (<a href="https://market.android.com/details?id=org.proxydroid">@AndroidMarket</a>) and
|
||||
<a href="http://code.google.com/p/sshtunnel/">sshtunnel</a> (<a href="https://market.android.com/details?id=org.sshtunnel">@AndroidMarket</a>). And that's over 100'000 downloads! Wow!</p>
|
||||
|
||||
<p>Another related issue is DNS over TCP. Redsocks includes `dnstc' that is fake
|
||||
and really dumb DNS server that returns "truncated answer" to every query via
|
||||
UDP. RFC-compliant resolver should repeat same query via TCP in this case - so
|
||||
the request can be redirected using usual redsocks facilities.</p>
|
||||
|
||||
<p>Known compliant resolvers are:</p>
|
||||
<ul>
|
||||
<li>bind9 (server)</li>
|
||||
<li>dig, nslookup (tools based on bind9 code)</li>
|
||||
</ul>
|
||||
<p>Known non-compliant resolvers are:</p>
|
||||
<ul>
|
||||
<li>eglibc resolver fails without any attempt to send request via TCP</li>
|
||||
<li>powerdns-recursor can't properly startup without UDP connectivity as it
|
||||
can't load root hints</li>
|
||||
</ul>
|
||||
|
||||
<p>On the other hand, DNS via TCP using bind9 may be painfully slow. If your bind9
|
||||
setup is really slow, you have at least two options: <a href="http://www.phys.uu.nl/~rombouts/pdnsd.html">pdnsd</a> caching server
|
||||
can run in TCP-only mode, <a href="http://www.mulliner.org/collin/ttdnsd.php">ttdnsd</a> (<a href="https://gitweb.torproject.org/ioerror/ttdnsd.git">git repo</a>) has no cache but can be useful for same
|
||||
purpose.</p>
|
||||
|
||||
<h2>Features</h2>
|
||||
|
||||
<p>Redirect any TCP connection to SOCKS4, SOCKS5 or HTTPS (HTTP/CONNECT)
|
||||
proxy server.</p>
|
||||
|
||||
<p>Login/password authentication is supported for SOCKS5/HTTPS connections.
|
||||
SOCKS4 supports only username, password is ignored. for HTTPS, currently
|
||||
only Basic and Digest scheme is supported.</p>
|
||||
|
||||
<p>Redirect UDP packets via SOCKS5 proxy server. NB: UDP still goes via UDP, so
|
||||
you can't relay UDP via OpenSSH.</p>
|
||||
|
||||
<p>Sends "truncated reply" as an answer to UDP DNS queries.</p>
|
||||
|
||||
<p>Redirect any HTTP connection to proxy that does not support transparent
|
||||
proxying (e.g. old SQUID had broken `acl myport' for such connections).</p>
|
||||
|
||||
|
||||
<h2>License</h2>
|
||||
|
||||
<p>All source code is licensed under Apache 2.0 license.</p>
|
||||
<p>You can get a copy at <a href="http://www.apache.org/licenses/LICENSE-2.0.html">http://www.apache.org/licenses/LICENSE-2.0.html</a></p>
|
||||
|
||||
|
||||
<h2>Packages</h2>
|
||||
<ul>
|
||||
<li><img src="http://www.archlinux.org/favicon.ico" alt="" />
|
||||
<a href="https://aur.archlinux.org/packages/redsocks-git">Archlinux AUR</a></li>
|
||||
|
||||
<li><img src="http://www.debian.org/favicon.ico" alt="" />
|
||||
<a href="http://packages.debian.org/search?searchon=names&keywords=redsocks">Debian</a></li>
|
||||
|
||||
<li><img src="http://www.gentoo.org/favicon.ico" alt="" />
|
||||
<a href="https://code.google.com/p/pentoo/source/browse/portage/trunk/net-proxy/redsocks">Gentoo (pentoo overlay)</a></li>
|
||||
|
||||
<li><img src="http://www.gentoo.org/favicon.ico" alt="" />
|
||||
<a href="http://code.google.com/p/theebuilds/source/browse/trunk/net-misc/redsocks">Gentoo (theebuilds overlay)</a></li>
|
||||
|
||||
<li><img src="http://www.gentoo.org/favicon.ico" alt="" />
|
||||
<a href="http://gpo.zugaina.org/net-proxy/redsocks">Gentoo (zugaina overlay)</a></li>
|
||||
|
||||
<li><img src="http://www.ubuntu.com/sites/all/themes/ubuntu10/favicon.ico" alt="" />
|
||||
<a href="http://packages.ubuntu.com/search?searchon=names&keywords=redsocks">Ubuntu</a></li>
|
||||
</ul>
|
||||
|
||||
|
||||
<h2>Compilation</h2>
|
||||
|
||||
<p><a href="http://libevent.org/">libevent-2.0.x</a> is required.</p>
|
||||
|
||||
<p>gcc is only supported compiler right now, other compilers can be used
|
||||
but may require some code changes.</p>
|
||||
|
||||
<p>Compilation is as easy as running `make', there is no `./configure' magic.</p>
|
||||
|
||||
<p>GNU Make works, other implementations of make were not tested.</p>
|
||||
|
||||
|
||||
<h2>Running</h2>
|
||||
|
||||
<p>Program has following command-line options:<br/>
|
||||
-c sets proper path to config file ("./redsocks.conf" is default one)<br/>
|
||||
-t tests config file syntax<br/>
|
||||
-p set a file to write the getpid() into</p>
|
||||
|
||||
<p>Following signals are understood:<br/>
|
||||
SIGUSR1 dumps list of connected clients to log<br/>
|
||||
SIGTERM and SIGINT terminates daemon, all active connections are closed</p>
|
||||
|
||||
<p>You can see configuration file example in redsocks.conf.example</p>
|
||||
|
||||
|
||||
<h2>iptables example</h2>
|
||||
|
||||
<p>You have to build iptables with connection tracking and REDIRECT target.</p>
|
||||
|
||||
<pre>
|
||||
# Create new chain
|
||||
<strong>root#</strong> <code>iptables -t nat -N REDSOCKS</code>
|
||||
|
||||
# Ignore LANs and some other reserved addresses.
|
||||
# See <a href="http://en.wikipedia.org/wiki/Reserved_IP_addresses#Reserved_IPv4_addresses">Wikipedia</a> and <a href="http://tools.ietf.org/html/rfc5735">RFC5735</a> for full list of reserved networks.
|
||||
<strong>root#</strong> <code>iptables -t nat -A REDSOCKS -d 0.0.0.0/8 -j RETURN</code>
|
||||
<strong>root#</strong> <code>iptables -t nat -A REDSOCKS -d 10.0.0.0/8 -j RETURN</code>
|
||||
<strong>root#</strong> <code>iptables -t nat -A REDSOCKS -d 100.64.0.0/10 -j RETURN</code>
|
||||
<strong>root#</strong> <code>iptables -t nat -A REDSOCKS -d 127.0.0.0/8 -j RETURN</code>
|
||||
<strong>root#</strong> <code>iptables -t nat -A REDSOCKS -d 169.254.0.0/16 -j RETURN</code>
|
||||
<strong>root#</strong> <code>iptables -t nat -A REDSOCKS -d 172.16.0.0/12 -j RETURN</code>
|
||||
<strong>root#</strong> <code>iptables -t nat -A REDSOCKS -d 192.168.0.0/16 -j RETURN</code>
|
||||
<strong>root#</strong> <code>iptables -t nat -A REDSOCKS -d 198.18.0.0/15 -j RETURN</code>
|
||||
<strong>root#</strong> <code>iptables -t nat -A REDSOCKS -d 224.0.0.0/4 -j RETURN</code>
|
||||
<strong>root#</strong> <code>iptables -t nat -A REDSOCKS -d 240.0.0.0/4 -j RETURN</code>
|
||||
|
||||
# Anything else should be redirected to port 12345
|
||||
<strong>root#</strong> <code>iptables -t nat -A REDSOCKS -p tcp -j REDIRECT --to-ports 12345</code>
|
||||
|
||||
# Any tcp connection made by `luser' should be redirected.
|
||||
<strong>root#</strong> <code>iptables -t nat -A OUTPUT -p tcp -m owner --uid-owner luser -j REDSOCKS</code>
|
||||
|
||||
# You can also control that in more precise way using `gid-owner` from
|
||||
# iptables.
|
||||
<strong>root#</strong> <code>groupadd socksified</code>
|
||||
<strong>root#</strong> <code>usermod --append --groups socksified luser</code>
|
||||
<strong>root#</strong> <code>iptables -t nat -A OUTPUT -p tcp -m owner --gid-owner socksified -j REDSOCKS</code>
|
||||
|
||||
# Now you can launch your specific application with GID `socksified` and it
|
||||
# will be... socksified. See following commands (numbers may vary).
|
||||
# Note: you may have to relogin to apply `usermod` changes.
|
||||
<strong>luser$</strong> <code>id</code>
|
||||
uid=1000(luser) gid=1000(luser) groups=1000(luser),1001(socksified)
|
||||
<strong>luser$</strong> <code>sg socksified -c id</code>
|
||||
uid=1000(luser) gid=1001(socksified) groups=1000(luser),1001(socksified)
|
||||
<strong>luser$</strong> <code>sg socksified -c "firefox"</code>
|
||||
|
||||
# If you want to configure socksifying router, you should look at
|
||||
# <a href="doc/iptables-packet-flow.png">doc/iptables-packet-flow.png</a> and <a href="doc/iptables-packet-flow-ng.png">doc/iptables-packet-flow-ng.png</a> and
|
||||
# <a href="https://en.wikipedia.org/wiki/File:Netfilter-packet-flow.svg">wikipedia/File:Netfilter-packet-flow.svg</a>
|
||||
# Note, you should have proper `local_ip' value to get external packets with
|
||||
# redsocks, default 127.0.0.1 will not go. See iptables(8) manpage regarding
|
||||
# <a href="http://dev.medozas.de/files/xtables/iptables.html#76">REDIRECT target</a> for details.
|
||||
# Depending on your network configuration iptables conf. may be as easy as:
|
||||
<strong>root#</strong> <code>iptables -t nat -A PREROUTING --in-interface eth_int -p tcp -j REDSOCKS</code>
|
||||
</pre>
|
||||
|
||||
<h3>Note about GID-based redirection</h3>
|
||||
<p>
|
||||
Keep in mind, that changed GID affects filesystem permissions, so if your
|
||||
application creates some files, the files will be created with luser:socksified
|
||||
owner/group. So, if you're not the only user in the group `socksified` and your
|
||||
umask allows to create group-readable files and your directory permissions, and
|
||||
so on, blah-blah, etc. THEN you may expose your files to another user.
|
||||
</p>
|
||||
<p>
|
||||
Ok, you have been warned.
|
||||
</p>
|
||||
|
||||
<h2>Homepage</h2>
|
||||
|
||||
<p>Homepage: <a href="http://darkk.net.ru/redsocks/">http://darkk.net.ru/redsocks/</a></p>
|
||||
|
||||
<p>Mailing list: <a href="mailto:redsocks@librelist.com">redsocks@librelist.com</a></p>
|
||||
|
||||
<p>Mailing list also has <a href="http://librelist.com/browser/redsocks/">archives</a>.</p>
|
||||
|
||||
|
||||
<h2>TODO</h2>
|
||||
|
||||
<ul>
|
||||
<li>Test OpenBSD (pf) and FreeBSD (ipfw) and write setup examples for those
|
||||
firewall types.</li>
|
||||
</ul>
|
||||
|
||||
|
||||
<h2>Author</h2>
|
||||
This program was written by Leonid Evdokimov.
|
||||
|
||||
|
||||
<!-- Outro -->
|
||||
<a name="address"></a>
|
||||
<pre>
|
||||
(~~~~~~~~~~\ __
|
||||
| jabber: ) / \
|
||||
| mailto: ( /|oo \
|
||||
\_________\(_| /_)
|
||||
_ @/_ \
|
||||
| | \ \\
|
||||
leon | (*) | \ )) darkk.net.ru
|
||||
|__U__| / \//
|
||||
_//|| _\ /
|
||||
(_/(_|(____/
|
||||
<a href="http://jigsaw.w3.org/css-validator/check/referer">Valid CSS!</a>
|
||||
<a href="http://validator.w3.org/check?uri=referer">Valid XHTML 1.0 Transitional</a>
|
||||
</pre>
|
||||
<!-- /Outro -->
|
||||
<!-- vim:set tabstop=2 softtabstop=2 shiftwidth=2: -->
|
||||
</body>
|
||||
</html>
|
||||
253
README.md
Normal file
253
README.md
Normal file
@ -0,0 +1,253 @@
|
||||
# redsocks – transparent TCP-to-proxy redirector
|
||||
|
||||
This tool allows you to redirect any TCP connection to SOCKS or HTTPS
|
||||
proxy using your firewall, so redirection may be system-wide or network-wide.
|
||||
|
||||
When is resocks useful?
|
||||
|
||||
* you want to route part of TCP traffic via OpenSSH `DynamicForward` Socks5
|
||||
port using firewall policies. That was original redsocks development goal;
|
||||
* you use DVB ISP and this ISP provides internet connectivity with some
|
||||
special daemon that may be also called "Internet accelerator" and the
|
||||
accelerator acts as a proxy and has no "transparent proxy" feature and you
|
||||
need it. [Globax](http://www.globax.biz) was an example of alike accelerator,
|
||||
but Globax 5 has transparent proxy feature. That was the second redsocks`
|
||||
development goal;
|
||||
* you have to pass traffic through proxy due to corporate network limitation.
|
||||
That was never a goal for redsocks, but users have reported success with
|
||||
some proxy configurations.
|
||||
|
||||
When is redsocks probably a wrong tool?
|
||||
|
||||
* redirecting traffic to [tor](https://www.torproject.org). First, you **have**
|
||||
to [use tor-aware software for anonymity](https://www.torproject.org/download/download.html.en#warning).
|
||||
Second, [use `TransPort`](https://trac.torproject.org/projects/tor/wiki/doc/TransparentProxy)
|
||||
if you don't actually need anonymity. Third, question everything :-)
|
||||
* trying to redirect traffic of significant number of connections over single
|
||||
SSH connection. That's not exactly [TCP over TCP](http://sites.inka.de/bigred/devel/tcp-tcp.html),
|
||||
but [head-of-line blocking](https://en.wikipedia.org/wiki/Head-of-line_blocking)
|
||||
will still happen and performance of real-time applications (IM, interactive
|
||||
Web applications) may be degraded during bulk transfers;
|
||||
* trying to make non-transparent HTTP-proxy (not HTTPS-proxy) transparent using
|
||||
`http-relay` module. First, it will likely be broken as the code is hack.
|
||||
Second, the code is vulnerable to `CVE-2009-0801` and will unlikely be ever fixed;
|
||||
* making "really" transparent proxy, redsocks acts at TCP level, so three-way
|
||||
handshake is completed and redsocks accepts connection before connection
|
||||
through proxy (and _to_ proxy) is established;
|
||||
* trying to redirect traffic of significant number of connections in
|
||||
resource-constrained environment like SOHO Linux router. Throughput of single
|
||||
connection may be good enough like 40 Mbit/s
|
||||
on [TP-Link TD-W8980](https://wiki.openwrt.org/toh/tp-link/td-w8980),
|
||||
but amount of concurrent connections may be limiting factor as TCP buffers
|
||||
are still consumed;
|
||||
* redirecting traffic to proxy on mobile device running Android or iOS as it'll require
|
||||
[rooting](https://en.wikipedia.org/wiki/Rooting_(Android)) to update firewall
|
||||
rules. Probably, the better way is to use on-device VPN daemon to intercept
|
||||
traffic via [`VpnService` API for Android](https://developer.android.com/reference/android/net/VpnService.html)
|
||||
and [`NETunnelProvider` family of APIs for iOS](https://developer.apple.com/documentation/networkextension).
|
||||
That may require some code doing [TCP Reassembly](https://wiki.wireshark.org/TCP_Reassembly)
|
||||
like [`tun2socks`](https://github.com/ambrop72/badvpn/wiki/Tun2socks).
|
||||
|
||||
Linux/iptables is supported. OpenBSD/pf and FreeBSD/ipfw may work with some
|
||||
hacks. The author has no permanent root access to machines running OpenBSD,
|
||||
FreeBSD and MacOSX to test and develop for these platforms.
|
||||
|
||||
[Transocks](http://transocks.sourceforge.net/) is alike project but it has
|
||||
noticable performance penality.
|
||||
|
||||
[Transsocks_ev](http://oss.tiggerswelt.net/transocks_ev/)
|
||||
is alike project too, but it has no HTTPS-proxy support
|
||||
and does not support authentication.
|
||||
|
||||
Several Android apps also use redsocks under-the-hood:
|
||||
[ProxyDroid](https://github.com/madeye/proxydroid)
|
||||
[<i class="fa fa-play"></i>](https://market.android.com/details?id=org.proxydroid) and
|
||||
[sshtunnel](https://code.google.com/archive/p/sshtunnel/)
|
||||
[<i class="fa fa-play"></i>](https://market.android.com/details?id=org.sshtunnel).
|
||||
And that's over 1'500'000 downloads! Wow!
|
||||
|
||||
## Features
|
||||
|
||||
Redirect any TCP connection to Socks4, Socks5 or HTTPS (HTTP/CONNECT)
|
||||
proxy server.
|
||||
|
||||
Login/password authentication is supported for Socks5/HTTPS connections.
|
||||
Socks4 supports only username, password is ignored. for HTTPS, currently
|
||||
only Basic and Digest scheme is supported.
|
||||
|
||||
Redirect UDP packets via Socks5 proxy server. NB: UDP still goes via UDP, so
|
||||
you can't relay UDP via OpenSSH.
|
||||
|
||||
Handle DNS/UDP queries sending "truncated reply" as an answer or making them
|
||||
DNS/TCP queries to some recursive resolver.
|
||||
|
||||
Redirect any HTTP connection to proxy that does not support transparent
|
||||
proxying (e.g. old SQUID had broken `acl myport' for such connections).
|
||||
|
||||
### Enforcing DNS over TCP using `dnstc`
|
||||
|
||||
DNS is running over UDP and it may be an issue in some environments as proxy
|
||||
servers usually don't handle UDP as a first-class citizen. Redsocks includes
|
||||
`dnstc` that is fake and really dumb DNS server that returns "truncated answer"
|
||||
to every query via UDP. RFC-compliant resolver should repeat same query via TCP
|
||||
in this case - so the request can be redirected using usual redsocks facilities.
|
||||
|
||||
Known compliant resolvers are:
|
||||
|
||||
* bind9 (server);
|
||||
* dig, nslookup (tools based on bind9 code).
|
||||
|
||||
Known non-compliant resolvers are:
|
||||
|
||||
* eglibc resolver fails without any attempt to send request via TCP;
|
||||
* powerdns-recursor can't properly startup without UDP connectivity as it
|
||||
can't load root hints.
|
||||
|
||||
On the other hand, DNS via TCP using bind9 may be painfully slow.
|
||||
If your bind9 setup is really slow, you may want to try
|
||||
[pdnsd](http://www.phys.uu.nl/~rombouts/pdnsd.html) caching server
|
||||
that can run in TCP-only mode.
|
||||
|
||||
### Relaying DNS/UDP to DNS/TCP via `dnsu2t`
|
||||
|
||||
The code acts as DNS server that multiplexes several UDP queries into single
|
||||
stream of TCP queries over keep-alive connection to upstream DNS server that
|
||||
should be recursive resolver. TCP connection may be handled by `redsocks`
|
||||
itself if firewall is configured with corresponding rules.
|
||||
|
||||
Different resolvers have different timeouts and allow different count of
|
||||
in-flight connections, so you have to tune options yourself for optimal
|
||||
performance (with some black magic, as script testing for optimal DNS/TCP
|
||||
connection parameters is not written yet).
|
||||
|
||||
There are other programs doing alike job (with, probably, different bugs)
|
||||
|
||||
* [ttdnsd](http://www.mulliner.org/collin/ttdnsd.php)
|
||||
* [dns2socks](https://github.com/qiuzi/dns2socks) for Windows
|
||||
* [tcpdnsproxy](https://github.com/jtripper/dns-tcp-socks-proxy)
|
||||
|
||||
## Source
|
||||
|
||||
Source is available at [<i class="fa fa-github"></i> GitHub](https://github.com/darkk/redsocks).
|
||||
|
||||
Issue tracker is also at GitHub, but keep in mind that the project is not
|
||||
actively maintained, so feature requests will unlikely be implemented within
|
||||
reasonable timeframe. Reproducable bugs having clean desciption will likely be
|
||||
fixed. Destiny of hard-to-reproduce bugs is hard to predict.
|
||||
|
||||
New network protocols will unlikely be implemented within this source tree, but
|
||||
if you're seeking for censorship circumvention protocols, you may want to take
|
||||
a look at [redsocks2](https://github.com/semigodking/redsocks) by Zhuofei Wang
|
||||
AKA @semigodking who is actively maintaining the fork with GFW in mind.
|
||||
|
||||
## License
|
||||
|
||||
All source code is licensed under Apache 2.0 license.
|
||||
You can get a copy at http://www.apache.org/licenses/LICENSE-2.0.html
|
||||
|
||||
## Packages
|
||||
|
||||
* Archlinux: https://aur.archlinux.org/packages/redsocks-git
|
||||
* Debian: http://packages.debian.org/search?searchon=names&keywords=redsocks
|
||||
* Gentoo (zugaina overlay): http://gpo.zugaina.org/net-proxy/redsocks
|
||||
* Gentoo: https://packages.gentoo.org/packages/net-proxy/redsocks
|
||||
* Ubuntu: http://packages.ubuntu.com/search?searchon=names&keywords=redsocks
|
||||
|
||||
## Compilation
|
||||
|
||||
[libevent-2.0.x](http://libevent.org/) is required.
|
||||
|
||||
gcc and clang are supported right now, other compilers can be used
|
||||
but may require some code changes.
|
||||
|
||||
Compilation is as easy as running `make`, there is no `./configure` magic.
|
||||
|
||||
GNU Make works, other implementations of make were not tested.
|
||||
|
||||
## Running
|
||||
|
||||
Program has following command-line options:
|
||||
|
||||
* `-c` sets proper path to config file ("./redsocks.conf" is default one)
|
||||
* `-t` tests config file syntax
|
||||
* `-p` set a file to write the getpid() into
|
||||
|
||||
Following signals are understood:
|
||||
SIGUSR1 dumps list of connected clients to log,
|
||||
SIGTERM and SIGINT terminates daemon, all active connections are closed.
|
||||
|
||||
You can see configuration file example in [redsocks.conf.example](https://github.com/darkk/redsocks/blob/master/redsocks.conf.example).
|
||||
|
||||
### iptables example
|
||||
|
||||
You have to build iptables with connection tracking and REDIRECT target.
|
||||
|
||||
```
|
||||
# Create new chain
|
||||
root# iptables -t nat -N REDSOCKS
|
||||
|
||||
# Ignore LANs and some other reserved addresses.
|
||||
# See http://en.wikipedia.org/wiki/Reserved_IP_addresses#Reserved_IPv4_addresses
|
||||
# and http://tools.ietf.org/html/rfc5735 for full list of reserved networks.
|
||||
root# iptables -t nat -A REDSOCKS -d 0.0.0.0/8 -j RETURN
|
||||
root# iptables -t nat -A REDSOCKS -d 10.0.0.0/8 -j RETURN
|
||||
root# iptables -t nat -A REDSOCKS -d 100.64.0.0/10 -j RETURN
|
||||
root# iptables -t nat -A REDSOCKS -d 127.0.0.0/8 -j RETURN
|
||||
root# iptables -t nat -A REDSOCKS -d 169.254.0.0/16 -j RETURN
|
||||
root# iptables -t nat -A REDSOCKS -d 172.16.0.0/12 -j RETURN
|
||||
root# iptables -t nat -A REDSOCKS -d 192.168.0.0/16 -j RETURN
|
||||
root# iptables -t nat -A REDSOCKS -d 198.18.0.0/15 -j RETURN
|
||||
root# iptables -t nat -A REDSOCKS -d 224.0.0.0/4 -j RETURN
|
||||
root# iptables -t nat -A REDSOCKS -d 240.0.0.0/4 -j RETURN
|
||||
|
||||
# Anything else should be redirected to port 12345
|
||||
root# iptables -t nat -A REDSOCKS -p tcp -j REDIRECT --to-ports 12345
|
||||
|
||||
# Any tcp connection made by `luser' should be redirected.
|
||||
root# iptables -t nat -A OUTPUT -p tcp -m owner --uid-owner luser -j REDSOCKS
|
||||
|
||||
# You can also control that in more precise way using `gid-owner` from
|
||||
# iptables.
|
||||
root# groupadd socksified
|
||||
root# usermod --append --groups socksified luser
|
||||
root# iptables -t nat -A OUTPUT -p tcp -m owner --gid-owner socksified -j REDSOCKS
|
||||
|
||||
# Now you can launch your specific application with GID `socksified` and it
|
||||
# will be... socksified. See following commands (numbers may vary).
|
||||
# Note: you may have to relogin to apply `usermod` changes.
|
||||
luser$ id
|
||||
uid=1000(luser) gid=1000(luser) groups=1000(luser),1001(socksified)
|
||||
luser$ sg socksified -c id
|
||||
uid=1000(luser) gid=1001(socksified) groups=1000(luser),1001(socksified)
|
||||
luser$ sg socksified -c "firefox"
|
||||
|
||||
# If you want to configure socksifying router, you should look at
|
||||
# doc/iptables-packet-flow.png, doc/iptables-packet-flow-ng.png and
|
||||
# https://en.wikipedia.org/wiki/File:Netfilter-packet-flow.svg
|
||||
# Note, you should have proper `local_ip' value to get external packets with
|
||||
# redsocks, default 127.0.0.1 will not go. See iptables(8) manpage regarding
|
||||
# REDIRECT target for details.
|
||||
# Depending on your network configuration iptables conf. may be as easy as:
|
||||
root# iptables -t nat -A PREROUTING --in-interface eth_int -p tcp -j REDSOCKS
|
||||
```
|
||||
|
||||
### Note about GID-based redirection
|
||||
|
||||
Keep in mind, that changed GID affects filesystem permissions, so if your
|
||||
application creates some files, the files will be created with luser:socksified
|
||||
owner/group. So, if you're not the only user in the group `socksified` and your
|
||||
umask allows to create group-readable files and your directory permissions, and
|
||||
so on, blah-blah, etc. THEN you may expose your files to another user.
|
||||
Ok, you have been warned.
|
||||
|
||||
## Homepage
|
||||
|
||||
http://darkk.net.ru/redsocks/
|
||||
|
||||
Mailing list: [redsocks@librelist.com](mailto:redsocks@librelist.com).
|
||||
|
||||
Mailing list also has [archives](http://librelist.com/browser/redsocks/).
|
||||
|
||||
## Author
|
||||
|
||||
This program was written by Leonid Evdokimov <leon@darkk.net.ru>
|
||||
Loading…
Reference in New Issue
Block a user