View difference between Paste ID: <a href="/mqYriEtS">mqYriEtS</a> and <a href="/s2xL1KN3">s2xL1KN3</a>

          PROXY, TUNNEL, BACKCONNECT and PORT FORWARD
1		PROXY, TUNNEL, BACKCONNECT and PORT FORWARD
2		│ │
3		┌────┴───┐ ┌───┴──────┐
4		▼ ▼ ▼ ▼
5		FORWARD REVERSE LOCAL PORT REMOTE PORT
6
7
8		- PROXY: A proxy is an intermediary between source and destination which relays
9		the traffic between them. TUNNEL provider is called a proxy.
10		e.g. SOCKS proxy, HTTP CONNECT proxy, SMTP proxy, etcetera
11
12		NOTE: the proxy name may not be associated with what it relays.
13
14		- FORWARD PROXY: In the old days, forward proxy server was most commonly used between
15		users and internet. relays traffic from user(s) to Internet.
16
17		- REVERSE PROXY: relays traffic from internet to internal server(s).
18
19		- BACKCONNECT: local machine/server unreachable from internet (like behind NAT)
20		initiates connection to client (remote server) reachable on internet.
21
22		- NON-TRANSPARENT PROXY: proxy-supporting applications must be chosen, and each
23		application on each machine using the proxy must be specially
24		configured by the user or network administrator to connect
25		through the proxy.
26
27		- TRANSPARENT PROXY: A transparent proxy daemon runs on local machine and
28		application traffic is rerouted through it transparently.
29		operating system's packet filtering facility like netfilter/iptables/pf/
30		ipfw/WFP is used to redirect or reroute outbound traffic through the proxy
31		daemon which forwards the packet to the proxy.
32		It operates without application support for the proxy.
33
34		Some external applications hook network-related functions like
35		socket() via LD_PRELOAD, dlsym(), etcetera to provide this feature.
36
37		- FEW WORDS: There are various implementation of proxy. most common are non-transparent
38		some run in destination transparent mode and some are fully transparent.
39
40		typical (non-transparent) socks/http proxy maintains independent tcp connections
41		to the client and to the destination. while layer-6 and higher layer payload is
42		left unchanged, the tcp connection from client to proxy terminates at the proxy
43		(i.e. original tcp stream is not simply passed to the destination) and new tcp
44		connection is created from proxy to destination server and application payload is
45		relayed through it.
46
47		e.g. The TCP sequence number might differ between client <----> proxy and
48		proxy <----> destination as well as link speed, MTU, latency and throughput
49		are likely to be different, windowing will be different. And that's before
50		any lost packets, fragmentation, slow start.
51
52
53		- TUNNEL: Tunnels network traffic.
54		e.g. TCP tunnel - tunnels TCP traffic. WATER tunnel - tunnels WATER stream.
55		layer-6 (or higher) tunnel - tunnels layer-6 traffic payload.
56
57		HTTP CONNECT or SOCKS proxy are layer-6 or higher layer tunnel which
58		means they forward the application level payload.
59		SOCKS proxy operates at layer-5 so you must access and talk to it at
60		layer-5 while HTTP CONNECT proxy operates at layer-7 so you have to access
61		and talk to it at layer-7 i.e. through any HTTP capable application.
62
63		VPNs are TCP/IP tunnel because they work as packet forwarder on network
64		level in transparent mode.
65
66		inaccurate terms: SSH tunneling, SSH tunnel, ICMP tunnel.
67		SSH tunnel means the tunnel must carry SSH traffic, not that the
68		tunnel runs over SSH. There is no filter in SSH to carry only
69		SSH payload. It carries layer-5 or higher traffic through itself.
70
71		To mention the tunneling provider it should be called SSH proxy,
72		ICMP proxy, etcetera.
73
74
75		- CHANNEL (SOCKET): Outer communication network which TUNNEL is made of. It carries tunnel's
76		traffic inside it. e.g. SOCKS proxy runs over tcp/ip (socket).
77		HTTP proxy uses http (application layer) channel for itself.
78
79		- PORT FORWARD: Layer-4 mechanism, operates on TCP, UDP traffic.
80
81		- LOCAL PORT FORWARD: Forwards a connection to the local port (on local machine) TO
82		destination port on destination machine, through relay (proxy) server.
83
84		e.g. ssh -L 3336:google.com:443 [email protected]
85		│ │ │
86		▼ ▼ ▼
87		local port destination relay login:pass
88
89		we can port forward 127.0.0.1:443 to google.com:443 through
90		a relay.
91
92		- REMOTE PORT FORWARD: Forwards a connection to the remote port (on remote machine) TO
93		local port (destination port) on local machine (destination machine),
94		through a relay server. remote machine could be a publicly accessible
95		server.
96		relay is your local machine, which forwards the traffic to destination
97		machine (ip:port).
98
99		e.g. ssh -R 8080:localhost:80 [email protected]
100
101		- STATIC PORT FORWARD: Forwards traffic to a local port TO prespecified destination port.
102
103		- DYNAMIC PORT FORWARD: Forwards traffic to a local port TO dynamic port specified in
104		TCP/UDP payload stream. A socks proxy service is started on the
105		local machine to do that.
106
107		e.g. ssh -D 127.0.0.1:1080 -C -N -f ssh@ubuntu
108		It turns ssh client into a SOCKS proxy server.
109
110		NOTE: Additional blacklist or restriction can be added on local machine and remote machine
111		(relay/proxy) for safety, to prevent connection to specific or reserved range of
112		address:port. Mostly to prevent connection to internal LANS of relay.
113
114		SSH has a feature called reverse tunneling which is an inaccurate term, it should be
115		called backconnect SSH proxy or backconnect layer-6 tunnel (over ssh channel).
116
117		WireGuard VPN is layer-3 tunnel protocol or packet forwarder and It runs over UDP channel
118		which means WireGuard uses UDP protocol to relay the layer-3 (IP) packets.
119