How to route traffic through different proxy servers based on destination

Question

Background

I work on a corporate network that is behind a proxy server. I also work with some remote sites that I am able to access via a bastion / jump host ssh proxy.

In my ~/.ssh/config I have a proxy configuration for my SSH tunnels that allows the jumping through our bastion hosts in order to reach the remote labs

Host *.remoteLab1
    ProxyCommand ssh -l USERNAME BASTIONHOST1 nc %h %p

Host *.remoteLab2
    ProxyCommand ssh -l USERNAME BASTIONHOST2 nc %h %p

I use both OSX and Linux so I assume the commands are more or less the same

Current Solution

My current solution is less than ideal. I basically make a socks connection to one of the remote labs such as:

ssh -D 1080 remoteLab1

ssh -D 1081 remoteLab2

Then in both realvnc and chrome I change the proxy server to localhost:1080 / localhost:1081. In chrome I have a plugin that allows me to do this and in VNC its manual.

As both of these remote labs have a unique domain I was wondering if there is an easier way playing with routing tables to send all traffic through these socks proxies based on ip address

Requested Solution

GIVEN: A socks5 tunnel is open on port 1080

GIVEN: A socks5 tunnel is open on port 1081

Requirements

• addresses of domain1.org go through 1080
• addresses of domain2.org go through 1081
• fall through case - everything else goes through standard proxy server

Nice-to-have's

• The solution is not permanent - it is enabled by a script in conjunction with turning on one of the socks tunnels

Is it possible to also map specific ip addresses as opposed to domains through one of the proxy servers

Ideas

I'm not really sure at all where to start with all of this. One solution I saw somewhere was to use a proxy.pac however the corporate network already has a proxy.pac and I wasn't sure if there is a way to do a fall-through pac where if not in my custom .pac then use the settings in the corporate .pac

Using the iptables or route command - however both of those are a little out of my knowledge zone

Setting up local loopbacks or something

Answer 1

I recommend changing your ProxyCommand from using nc to use -W. For example:

ProxyCommand ssh -l USERNAME BASTIONHOST1 -W %h:%p

That has fewer requirements for the bastion host, so it is less likely to break in case the administrator decides to change how the bastion host is configured.

I don't think there is any way to fall through between different pac files. But you can more or less just concatenate the two pac files - with one minor caveat. The entry point would exist in both files. You would need to rename the entry point in the original pac file and in your own additions you can make calls to the renamed version of the function.

Historically the entry point was a function named FindProxyForURL. Some newer browsers have extensions which are activated by using a differently named entry point.