EdgeRouter DNAT for Remote Socks Proxy Server

I set up an HAProxy for socks 5 proxy server on my edgerouters, listening on 0.0.0.0:31080, forwarding to proxy server tunneled at 10.99.99.2:31080. You can find it: UBNT VPN + Socks5 代理.

I chose this because of failure on setting destination NAT.

The BAD thing is, HAProxy DOES NOT SUPPORT UDP. If I set foxyproxy resolving names from remote, connections are lost.

I tried many many times, and find out why I got failed setting DNAT.

Continue reading “EdgeRouter DNAT for Remote Socks Proxy Server” »

EdgeRouter DNAT for Remote Socks Proxy Server by @sskaje: https://sskaje.me/2016/06/edgerouter-dnat-remote-socks-proxy-server/

Incoming search terms:

EdgeRouter Lite: Source Based Routing

I have 192.168.1.1/24 on my eth0 as LAN, VPN set up.
For some cases, I want to visit some web site via VPN, I set up a socks 5 proxy.
But socks 5 is not an option for iPhone & Android by default.

So I added 192.168.10.1/24 to eth0 at the same time, traffic from 192.168.10.0/24 are all forwarded to VPN interface.

If I want my iPhone traffic fully routed to VPN, I just need to change my iPhone WiFi addresses.

EdgeRouter Lite: Source Based Routing by @sskaje: https://sskaje.me/2016/03/edgerouter-lite-source-based-routing/

EdgeRouter PPtP Server访问本地DNS服务

UBNT EdgeRouter 自带了PPTP Server,典型的配置方法是

官方参考guide: https://help.ubnt.com/hc/en-us/articles/205220840-EdgeMAX-PPTP-VPN-with-local-users-RADIUS

这个案例里,我的路由eth0是LAN口,eth0的IP是 192.168.100.1,这个配置下我的pptp客户端能正常访问到我的内网的机器。
但是如果我需要把DNS设成 192.168.100.1,DNS请求就会一直没响应。
路由端抓 UDP 53 的包,可以看到pptp客户端发出的dns请求,但是没有回包。
看了眼/etc/dnsmasq.conf:

man dnsmasq

-i, –interface=
Listen only on the specified interface(s). Dnsmasq automatically adds the loopback (local) interface to the list of interfaces to use when the –interface option is used. If no –interface or –listen-address options
are given dnsmasq listens on all available interfaces except any given in –except-interface options. IP alias interfaces (eg “eth1:0”) cannot be used with –interface or –except-interface options, use –listen-
address instead. A simple wildcard, consisting of a trailing ‘*’, can be used in –interface and –except-interface options.

尝试了加一个 interface=pptp*,无效。
顺手先把dnsmasq的请求隔离到一个新的网段 192.168.101.0/24,服务端的local-ip设成 192.168.101.1,推送dns 192.168.101.1,再设置options ‘listen-address=192.168.101.1’,解决。
全部命令如下

EdgeRouter PPtP Server访问本地DNS服务 by @sskaje: https://sskaje.me/2016/02/edgerouter-pptp-server-dns-service/

Incoming search terms:

UBNT VPN + Socks5 代理

VPN的方案可以参考 Set up OpenVPN Site-to-Site on UBNT EdgeRouter LiteEdgeOS PPTP VPN客户端配置

由于某些国际CDN的问题,部分网站不适合用IP路由来设定跳转。所以这里的需求是,针对特定域名把80/443的请求转由VPN的设备出去,其他的不管。
思路1,用EdgeMax自带的webproxy功能,但是很可惜,squid不支持选择outgoing的interface,只能选目标IP。所以放弃。
思路2,DPI监测域名或SNI,但是EdgeRouter Lite的最新版beta 1.8.0b3文档不完整,自己测试了一下相关命令,没搞成,理论上有戏。
思路3,本地socks5代理。我一直会用firefox+foxyproxy作为专用浏览器,正常的需求都用chrome。而且最近secure pipes经常掉,不确定什么情况,包括用国内vps代理远端ssh的方案也不行。

尝试了一些方案,包括dante-server 选上行interface, SSH Tunnel + DNAT,都不行。DNAT的方案不想直接用iptables,怕配置命令保存不方便,所以最终回到了haproxy的方案。

VPS上,配置socks5代理。方案很简单,参考命令如下:

10.99.99.2 和 192.168.121.1 分别是我两种vpn方案的服务端私有IP。
这行命令被我加到了rc.local。当然,还得配ssh 公钥登录。

路由上,安装配置haproxy。依旧参考 使用HAProxy搭建SSH代理
/etc/haproxy/haproxy.cfg

UBNT VPN + Socks5 代理 by @sskaje: https://sskaje.me/2016/02/ubnt-vpn-socks5-proxy/

Incoming search terms:

Set up OpenVPN Site-to-Site on UBNT EdgeRouter Lite

参考:https://help.ubnt.com/hc/en-us/articles/204949694-EdgeMAX-OpenVPN-Site-to-Site
不同的是,我一端是Ubuntu Linux,另一端是EdgeRouter Lite。

实现的目的也是让EdgeRouter连上远程vpn实现XXXX。
PPTP的方案参考:EdgeOS PPTP VPN客户端配置

环境

Ubuntu Linux, 10.99.99.2
EdgeRouter Lite, 10.99.99.1

配置EdgeRouter Lite

SSH到Ubnt EdgeRouter Lite
生成共享密钥文件

执行命令创建VPN

执行命令启用NAT

如果需要重启tunnel

配置Linux

安装openvpn

把EdgeRouter的 /config/auth/secret 复制到 /etc/openvpn/er-site2site-static.key

编辑 /etc/openvpn/server.conf

启动openvpn

测试

在EdgeRouter ping Linux

在Linux ping EdgeRouter

如果还有问题,可以看日志

配置路由

参考下一篇文章 UBNT EdgeOS 配置设备路由(interface-route)的方法

Set up OpenVPN Site-to-Site on UBNT EdgeRouter Lite by @sskaje: https://sskaje.me/2016/02/set-openvpn-site-to-site-ubnt-edgerouter-lite/

Incoming search terms: