vital21 wrote:Hi, would you mind to give some advices or a brief guide "how to setup" using your method?
Its quite a long story and probably impossible to do for copy-pasters 
But fundamentally its quite easy, you just need to understand the logic, then process becomes interesting. Also may be some my decisions are not perfect, if you can suggest something shorter and more effective pls do it.
1)
openssh (not dropbear) client can give you local socks on selected port using server's ssh port redirection
create another (non-root) user, su, use ssh-keygen to create keys, copy pub key to "authorized_keys" on server (google for configuring key authentication in openssh)
After all done test if it works with curl.
opkg update
opkg install --force-overwrite openssh-client openssh-client-utils curl shadow-useradd
useradd -d /home/proxy proxy
mkdir -p /home/proxy
chown proxy:proxy /home/proxy
# openssh client barks if it has no access to /dev/tty
echo "chmod 666 /dev/tty" >>/etc/rc.local
chmod 666 /dev/tty
su proxy
cd
mkdir -m 700 .ssh
cd .ssh
ssh-keygen
# should see id_rsa id_rsa.pub
ls
# copy id_rsa.pub to authorized_keys on server
ssh -N -D 1098 -l proxy vps.mydomain.com
# in parallel session test with curl
curl --socks5 127.0.0.1:1098 http://google.com
2)
Create a way to keep openssh always running. Restart it if it disconnects.
/etc/init.d/socks_vps :
#!/bin/sh /etc/rc.common
# opkg install procps-ng-pgrep coreutils-nohup
START=95
STOP=10
USER=proxy
SCRIPT_DIR=/etc/my
SCRIPT=socks_vps.sh
LOGDIR=/var/log/socks_vps
restart() {
stop
start
}
start() {
[ -d $LOGDIR ] || {
mkdir $LOGDIR
chown $USER $LOGDIR
}
pgrep -U $USER $SCRIPT >/dev/null || su -c $SCRIPT_DIR/$SCRIPT $USER &
}
stop() {
killall $SCRIPT 2>/dev/null
PID=$(pgrep -U $USER ssh)
[ -n "$PID" ] && kill $PID
sleep 1
return 0
}
/etc/my/socks_vps.sh
#!/bin/sh
# opkg install coreutils-nohup
trap "" SIGHUP SIGINT
while :
do
nohup ssh -4 -N -D 1098 -l proxy vps.mydomain.com >/dev/null 2>/var/log/socks_vps/svps.2.log
sleep 10
done
opkg install procps-ng-pgrep coreutils-nohup
chmod +x /etc/my/socks_vps.sh
chmod +x /etc/init.d/socks_vps
Start : /etc/init.d/socks_vps start
Stop : /etc/init.d/socks_vps stop
Enable autoload : /etc/init.d/socks_vps enable
3) (updated)
Obtain redsocks package. Its present only in CC 15.05 and DD+. CC and DD use different libc and executables are not compatible. If you're on 15.05 or DD - just install from repo. If you're on <15.05 then take ipk from 15.05 and install manually.
4) Configure redsocks and make it always running.
/etc/redsocks.conf
........
local_ip = 127.0.0.1;
local_port = 1099;
........
ip = 127.0.0.1;
port = 1098;
type = socks5;
........
The shit is that it cant start with normal /etc/init.d script because at the moment of its execution even "lo" is not up and executable exits with error. So hang on hotplug event and start from there
/etc/hotplug.d/iface/99-exec-on-updown
#!/bin/sh
local cmd
if [ "$ACTION" = ifup ]; then
cmd=$(uci get network.$INTERFACE.exec_on_up)
[ -n "$cmd" ] && $cmd
fi
if [ "$ACTION" = ifdown ]; then
cmd=$(uci get network.$INTERFACE.exec_on_down)
[ -n "$cmd" ] && $cmd
fi
/etc/init.d/network
config interface 'wan'
........
option exec_on_up '/etc/init.d/redsocks start'
# autostart not working because network is down
/etc/init.d/redsocks disable
/etc/init.d/redsocks start
5)
And the final part. Create iptables filter to redirect some connections to transparent proxy "redsocks"
The reason why I started all this is russian censorship machine. They block web sites. I break http by fooling DPI but https must be redirected. I created ipset "zapret". It contains blocked IP addresses
/etc/firewall.user
SOXIFIER_PORT=1099
. /lib/functions/network.sh
# connections originating from router
network_find_wan wan_iface
for ext_iface in $wan_iface; do
network_get_device ext_device $ext_iface
iptables -t nat -C OUTPUT -p tcp --dport 443 -o $ext_device -m set --match-set zapret dst -j REDIRECT --to-port $SOXIFIER_PORT ||
iptables -t nat -I OUTPUT -p tcp --dport 443 -o $ext_device -m set --match-set zapret dst -j REDIRECT --to-port $SOXIFIER_PORT
done
# forwarded connections
sysctl -w net.ipv4.conf.br-lan.route_localnet=1
iptables -t nat -C prerouting_lan_rule -p tcp --dport 443 -m set --match-set zapret dst -j DNAT --to 127.0.0.1:$SOXIFIER_PORT ||
iptables -t nat -I prerouting_lan_rule -p tcp --dport 443 -m set --match-set zapret dst -j DNAT --to 127.0.0.1:$SOXIFIER_PORT
Note that kernels before 3.10 cant DNAT to 127.0.0.1. They treat it as "martian" IP and deny.
uname -a
If version is older then bind redsocks to LAN address instead of 127.0.0.1 and change DNAT address as well or replace DNAT with REDIRECT.
Also check if iptables support "-C" command line option. Very old versions (AA) cannot.
Check if iptables has all required filter modules, install missing modules if it barks.
Only TCP can be redirected, UDP cannot
(Last edited by bolvan on 3 Nov 2016, 20:45)
