proxy-socks

TL;DR follow these instructions to start building a flexible residential back-connect proxy network on any platform running Electron.

about

This Electron desktop app forwards socksPort and squidPort to proxyRemote IP on the remote server over SSH and in reverse, forwards a random port on a remote Linux box to a SOCKS proxy running locally.

Clients connecting to squidPort or socksPort on the machine running the app, will be tunneled to proxyRemote on remote server. Similarly, remote SOCKS connections will be proxied out the local WAN interface of the machine running the app. It is up to you to handle incoming client connections on the remote server using HAProxy, Squid, etc.

instructions

• deploy an Ubuntu or Debian box to be the proxy concentrator and note its public IP (e.g. on DigitalOcean)

client config

• create SSH key locally and copy to the the proxy concentrator

    mkdir -p ~/.proxy-socks\
      && echo -e 'y\n' | ssh-keygen -f ~/.proxy-socks/id_rsa\
      && ssh-copy-id -i ~/.proxy-socks/id_rsa.pub root@{proxy-concentrator}
  

• create config.json, with the hostname or IP address of the proxy concentrator and adjust ports if required

cat << EOF > ~/.proxy-socks/config.json
{
    "username": "tunnel",
    "host": "{proxy-concentrator}",
    "port": 22,
    "privateKey": "${HOME}/.proxy-socks/id_rsa",
    "squidPort": 3128,
    "socksPort": 1080,
    "proxyRemote": "172.20.0.10"
}
EOF

server config

• on the proxy concentrator create tunnel user, set a password and authorize keys

    useradd -m tunnel -s /bin/bash\
      && mkdir -p /home/tunnel/.ssh\
      && cat ~/.ssh/authorized_keys > /home/tunnel/.ssh/authorized_keys
  

• create splash script and set permissions

cat << EOF > /home/tunnel/splash.sh
#!/bin/sh
echo '+--------------------------+'
echo '|                          |'
echo '|  Nothing to see here...  |'
echo '|                          |'
echo '+--------------------------+'
EOF

chmod +x /home/tunnel/splash.sh
chown tunnel:tunnel -hR /home/tunnel

• update sshd config and restart the service

cat << EOF >> /etc/ssh/sshd_config

Match User tunnel
  ForceCommand /home/tunnel/splash.sh
EOF

service ssh restart

installing

The Windows binary is not signed and modern Chrome/Windows will try to prevent it from running. If this is important to you, you can get a signing certificate from one of the vendors and build a signed release.

OS	release
Windows	latest, 1.0.4, 1.0.3, 1.0.2, 1.0.1, 1.0.0
Linux (AppImage)	latest, 1.0.4, 1.0.3, 1.0.2, 1.0.1, 1.0.0
Linux (Snap)	latest, 1.0.4, 1.0.3, 1.0.2, 1.0.1, 1.0.0
Mac OS X	latest, 1.0.4, 1.0.3, 1.0.2, 1.0.1, 1.0.0

• launch the app and note the forwarded port number

The app will attempt to insert itself into the appropriate start-up chain to start automatically with the operating system and appear minimised to tray.

• test connectivity to the proxy from the proxy concentrator

    # netstat -a -n -p | grep LISTEN | grep 127.0.0.1
    tcp        0      0 127.0.0.1:{zzz}         0.0.0.0:* ...
  
    root@ubuntu:# curl -4 ifconfig.co
    {xxx}
  
    root@ubuntu:# curl -4 --socks5 localhost:{zzz} ifconfig.co
    {yyy}
  

you should see a random TCP port and two different public IPs if everything is working correctly

IPv6

the server is listening on both AF_INET and AF_INET6 sockets

    # netstat -a -n -p | grep LISTEN | grep ::1
    tcp6       0      0 ::1:{zzz}               :::* ...

    root@ubuntu:# curl -6 ifconfig.co
    {xxx}

    root@ubuntu:# curl -6 --socks5 localhost:{zzz} ifconfig.co
    {yyy}

next steps

Every new installation of the app, will attempt to make a connection to the remote server and forward a random port to the local proxy. These proxies can then be exposed on the public interface of the server using HAProxy, OpenVPN or a combination of tools.

An example shell script can be used to automatically generate HAProxy configuration for all connected proxies.

Once the ports are exposed, ensure appropriate ACLs are set.

---

© 2018 belodetek