Thanks to Jon for reminding me that there is something better then flaky public proxies and the over-taxed Tor network. Tor is still better if you want end-to-end security and anonymity, but if you just want a secure hop out of the local censored network and after that you do not care, renting a cheap server (as little as $8/month at vpslink, 100G of bandwidth included) is a simple and easy option.
Assuming your remote server is called hostname.com, setting up an encrypted tunnel is as simple as executing this on a local terminal (must be root):
ssh -v -CND 1080 firstname.lastname@example.org
Note that for my own Debian server on the other end of the SSH proxy tunnel, I have found that "username" cannot be "root". I am not sure why this is (and it is definitely counter-intuitive) but if I try to tunnel to the root account on my server, when I try to use the tunnel to browse to a website it does not work and the following error is reported:
channel 1: open failed: administratively prohibited: open failed
If I tunnel to an ordinary user account on my server, I get no error and everything works. Go figure.....
To semi-automate this I created an alias in my ~/.bashrc:
tunnel="autossh -M 0 -v -CND 1080 email@example.com"
Thereafter, in any terminal, just invoke "tunnel" to create the encrypted tunnel. (To eliminate the password prompt, setup passwordless authentication.)
Any browser can use this proxy, by pointing its proxy setting at localhost and port 1080, with SOCKS 5 turned on. The Firefox FoxyProxy plugin makes this infinitely more flexible by allowing the simultaneous configuration of multiple proxies, and providing fine-grained control over which websites are accessed using which proxies.
Once FoxyProxy is installed into Firefox, you have the option of selecting any one proxy (or none) for all of your surfing, or associating certain websites with certain proxies and running FoxyProxy in "Patterns" mode. Since youtube is often getting itself blocked, a pattern for youtube would be:
While you are at it, install privoxy and make it your default proxy for websites that have not been diverted to Tor or your just created personal proxy. Privoxy blocks a lot of advertisements and information gathering by nosy websites.
Finally, note that
ssh -v -CND 1080 firstname.lastname@example.org
will only allow connections from the localhost. To allow connections from other computers over your local network, start it like this for example:
ssh -v -CND [192.168.8.58]:1080 email@example.com
This will allow any connections to port 1080 on the machine's exterior network interface. To start this as a persistent service at boot, add the following line to /etc/rc.local:
su username -c 'autossh -M 0 -v -CND [192.168.8.58]:1080 firstname.lastname@example.org'&
where username is the account you wish the service to run under.
My SSH Socks5 proxy works great, especially with the addition of autossh, but unlike most web browsers and Pidgin, many applications (particularly on the command line) just do not have proxy support built in.
Proxychains is a wrapper that redirects all network traffic through a designated proxy. To get it working is very simple. After installing, I made this change to the bottom of /etc/proxychains.conf:
# defaults set to "tor"
# socks4 127.0.0.1 9050
socks5 127.0.0.1 1082
ie. I commented out the default Tor proxy and added my local SSH socks5 proxy which I have placed on port 1082.
Then, for instance, to send my gpodder podcatcher through the SSH tunnel, I just start gpodder in a terminal as follows:
Then all of gpodder's network traffic (DNS queries included) go out via SSH through my out-of-country server. And now I have restored access to many blocked podcasts, PGP key servers, and no doubt many other things as they come up. I have been looking for something like this for years.
Sometimes the bandwidth is so bad here (or is it the "Great Firewall" deliberately trying to break my connection?) that my SSH tunnel will frequently fail. Very inconvenient, as I do not notice until I need it, then I have to do a manual restart and wait for it to connect (and said wait can sometimes be significant when bandwidth sucks...)
I have setup an alias in my .bashrc as follows:
alias tunnel="autossh -M 0 -v -CND 1082 email@example.com"
To start the tunnel at the beginning of the day, I just type "tunnel" in any terminal. And whenever the ssh connection is broken, autossh automatically (and apparently intelligently) restarts it. So far, so good.