Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- PROXY, TUNNEL, BACKCONNECT and PORT FORWARD
- │ │
- ┌────┴───┐ ┌───┴──────┐
- ▼ ▼ ▼ ▼
- FORWARD REVERSE LOCAL PORT REMOTE PORT
- - PROXY: A proxy is an intermediary between source and destination which relays
- the traffic between them. TUNNEL provider is called a proxy.
- e.g. SOCKS proxy, HTTP CONNECT proxy, SMTP proxy, etcetera
- NOTE: the proxy name may not be associated with what it relays.
- - FORWARD PROXY: In the old days, forward proxy server was most commonly used between
- users and internet. relays traffic from user(s) to Internet.
- - REVERSE PROXY: relays traffic from internet to internal server(s).
- - BACKCONNECT: local machine/server unreachable from internet (like behind NAT)
- initiates connection to client (remote server) reachable on internet.
- - NON-TRANSPARENT PROXY: proxy-supporting applications must be chosen, and each
- application on each machine using the proxy must be specially
- configured by the user or network administrator to connect
- through the proxy.
- - TRANSPARENT PROXY: A transparent proxy daemon runs on local machine and
- application traffic is rerouted through it transparently.
- operating system's packet filtering facility like netfilter/iptables/pf/
- ipfw/WFP is used to redirect or reroute outbound traffic through the proxy
- daemon which forwards the packet to the proxy.
- It operates without application support for the proxy.
- Some external applications hook network-related functions like
- socket() via LD_PRELOAD, dlsym(), etcetera to provide this feature.
- - FEW WORDS: There are various implementation of proxy. most common are non-transparent
- some run in destination transparent mode and some are fully transparent.
- typical (non-transparent) socks/http proxy maintains independent tcp connections
- to the client and to the destination. while layer-6 and higher layer payload is
- left unchanged, the tcp connection from client to proxy terminates at the proxy
- (i.e. original tcp stream is not simply passed to the destination) and new tcp
- connection is created from proxy to destination server and application payload is
- relayed through it.
- e.g. The TCP sequence number might differ between client <----> proxy and
- proxy <----> destination as well as link speed, MTU, latency and throughput
- are likely to be different, windowing will be different. And that's before
- any lost packets, fragmentation, slow start.
- - TUNNEL: Tunnels network traffic.
- e.g. TCP tunnel - tunnels TCP traffic. WATER tunnel - tunnels WATER stream.
- layer-6 (or higher) tunnel - tunnels layer-6 traffic payload.
- HTTP CONNECT or SOCKS proxy are layer-6 or higher layer tunnel which
- means they forward the application level payload.
- SOCKS proxy operates at layer-5 so you must access and talk to it at
- layer-5 while HTTP CONNECT proxy operates at layer-7 so you have to access
- and talk to it at layer-7 i.e. through any HTTP capable application.
- VPNs are TCP/IP tunnel because they work as packet forwarder on network
- level in transparent mode.
- inaccurate terms: SSH tunneling, SSH tunnel, ICMP tunnel.
- SSH tunnel means the tunnel must carry SSH traffic, not that the
- tunnel runs over SSH. There is no filter in SSH to carry only
- SSH payload. It carries layer-5 or higher traffic through itself.
- To mention the tunneling provider it should be called SSH proxy,
- ICMP proxy, etcetera.
- - CHANNEL (SOCKET): Outer communication network which TUNNEL is made of. It carries tunnel's
- traffic inside it. e.g. SOCKS proxy runs over tcp/ip (socket).
- HTTP proxy uses http (application layer) channel for itself.
- - PORT FORWARD: Layer-4 mechanism, operates on TCP, UDP traffic.
- - LOCAL PORT FORWARD: Forwards a connection to the local port (on local machine) TO
- destination port on destination machine, through relay (proxy) server.
- e.g. ssh -L 3336:google.com:443 [email protected]
- │ │ │
- ▼ ▼ ▼
- local port destination relay login:pass
- we can port forward 127.0.0.1:443 to google.com:443 through
- a relay.
- - REMOTE PORT FORWARD: Forwards a connection to the remote port (on remote machine) TO
- local port (destination port) on local machine (destination machine),
- through a relay server. remote machine could be a publicly accessible
- server.
- relay is your local machine, which forwards the traffic to destination
- machine (ip:port).
- e.g. ssh -R 8080:localhost:80 [email protected]
- - STATIC PORT FORWARD: Forwards traffic to a local port TO prespecified destination port.
- - DYNAMIC PORT FORWARD: Forwards traffic to a local port TO dynamic port specified in
- TCP/UDP payload stream. A socks proxy service is started on the
- local machine to do that.
- e.g. ssh -D 127.0.0.1:1080 -C -N -f ssh@ubuntu
- It turns ssh client into a SOCKS proxy server.
- NOTE: Additional blacklist or restriction can be added on local machine and remote machine
- (relay/proxy) for safety, to prevent connection to specific or reserved range of
- address:port. Mostly to prevent connection to internal LANS of relay.
- SSH has a feature called reverse tunneling which is an inaccurate term, it should be
- called backconnect SSH proxy or backconnect layer-6 tunnel (over ssh channel).
- WireGuard VPN is layer-3 tunnel protocol or packet forwarder and It runs over UDP channel
- which means WireGuard uses UDP protocol to relay the layer-3 (IP) packets.
Add Comment
Please, Sign In to add comment
