I need VPN-like behavior locally, without using a VPN.

I've created a SOCKS proxy to a given server which is reachable from the WAN, and I want all of my traffic forwarded through that proxy so I can reach hosts inside of that network.

My SOCKS proxy looks like this:

ssh -t -D 8088 user@proxy-host 'watch -n 1 date'

I've setup my system to proxy though this using the System Settings:

enter image description here

I've verified that my environment variables are being set properly:

naftuli@macbook-nkay:~$ env | grep socks_proxy

However, when I go to SSH to a given server, I can't reach it:

$ ssh internal-host
ssh: Could not resolve hostname internal-host: Name or service not known

I think that the problem is that DNS isn't being forwarded over the SOCKS tunnel. Is there a way to set that up? I was able to configure Firefox to manually use remote DNS and it worked great. Is there an environment variable for this?


Similar topic was discussed in SU:

openssh itself doesn't understand the socks_proxy environment variables. You need to use for example netcat to direct the traffic over the proxy:

 ssh -o ProxyCommand='nc -X 5 --proxy %h %p' user@host

To forward DNS requests, it will be more complicated, because low-level functions in openssh do not respect environmental variables. You will probably need to set up your local DNS resolver, which will forward the requests to the proxy. There is dns-tcp-socks-proxy, which should handle.

./dns_proxy --socks_port=8088 --listen_port=53

When you will have this daemon running, you should set up the your /etc/resolv.conf (hope Mac respects this one) to use this DNS.


Simple test should be possible using dig again, but when this resolver if functional, you will not need the proxy part:

dig example.com

Alternative as jumpbox:

As an easy alternative, I can recommend using normal the host as a jumphost, skip the proxy part and do IO redirect using -W switch:

ssh -oProxyCommand="ssh -W %h:%p jumpbox" destination_host

It should do the dns resoving and routing on the jumpbox. This option can be easily incorporated into your ~/.ssh/config

  • Having trouble finding a way to tunnel DNS, Firefox and Chrome can do it, but it seems that OpenSSH can't. Nov 20 '15 at 22:04
  • Yes. I see. Doing single DNS request sounds possible: dig --socks5 @ example.com, but forcing to do it on low-level will be more complicated. Still looking into this, since this sounds like nice topic.
    – Jakuje
    Nov 20 '15 at 22:14
  • added comments about DNS. Conceptually it should be possible to make it working this way on Linux, so hopefully also on Mac.
    – Jakuje
    Nov 20 '15 at 22:28
  • I added possible alternative, that should do the same job without bothering with third party tools but is not using the SOCKS proxy.
    – Jakuje
    Nov 20 '15 at 23:41
  • ncat has a command line option: --proxy-type socks5 which is required to be specified for a SOCKSv5 proxy. Oct 20 '19 at 12:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.