Hot answers tagged

5

Port forwarding describes a layer-4 mechanism, operating on TCP connections or UDP packets without necessarily understanding the application data. Reverse proxy suggests a higher-layer (this is where the OSI model doesn't map directly to TCP/IP) application-aware proxy. In the old days, a proxy server was most commonly used between users and the Internet; ...


5

The DNS is issued by default from your local host, not from the proxy, when using SOCKS (probably because SOCKS4 didn't support other way). Make sure you have checked the checkbox "Remote DNS" in the Proxy configuration of the Firefox:


4

You are mixing layers. A gateway routes IP traffic, a proxy works for HTTP(S) traffic (which is payload in IP packets). So unless your proxy server does both and also routes IP packets, you're breaking things by setting the gateway to your proxy server.


4

My understanding is that, theoretically speaking, this should be handled on the network level and not the application level. Forgive me, but this is just wrong. At the network layer (or internetwork layer in the TCP/IP model), there are no logical connections, no sessions, no conversations, just individual packets. There is no mechanism to associate one ...


3

A proxy is usually a user space program which maintains independent TCP connections to the client and to the server. While the application layer payload might be left unchanged by the proxy (or not, proxies often add some HTTP header like Via and/or X-Forwarded-For) the original TCP packets are not simply passed through but new packets are created. With ...


3

A gateway is a device that can send traffic to a different network. The gateway operates on the same data-link LAN as the source device, which sends traffic destined to a different LAN to the gateway. The OSI model doesn't have a "dialogue layer." I presume the quote means the application layer. Typically, a proxy server is for an application (usually web ...


3

Basically, port forwarding is creating a manual, static entry in the NAPT table. The table will build dynamic entries as traffic is sent from inside to outside (these entries will eventually close or time out) so that traffic can return to the original sender. If the original sender is on the outside, the table will not have an entry for that. To allow ...


3

This actually depend on which kind of proxy you are talking about. The most common type (and the one it seems you are referring to) is an HTTP proxy. HTTP is a application protocol and as such an HTTP proxy belongs to the application layer. The Internet layer doesn't care about the transported protocol, so it cannot distinguish between an HTTP request or ...


2

To be more specific, if the packet is not on the connected network, the computer will forward it to the address (next-hop) based on the longest match in the routing table. For most computers, there is only one route in the table, known as the default route. The next-hop of the default route is usually called the default gateway. The gateway is often a ...


2

If you enter this configuration, here's what will happen: Your router will use ARP to find the MAC address for 192.168.xxx.xxx. Whenever your router wants to send an IP packet to anywhere (that it doesn't have a more specific route for), it will send it to that MAC address. The device whose IP address is 192.168.xxx.xxx is now responsible for getting that ...


2

Can I use this rule to to specify 192.168.xxx.xxx as my default proxy server? No. A proxy is specified for an application-layer protocol (esp. HTTP/S). A default route points to a network-layer gateway. You need to be able to route to your proxy (which could be on the other side of the world). The config to use that proxy is either within the application (...


2

DNS-based port forwarding isn't a thing. The transport layer has no idea about DNS names. The only way to do something like that is with an application-layer (aware) proxy and, of course, an application-layer protocol that uses host names, like HTTP. With just a single IP address, you'll need a dedicated TCP port for OpenVPN (and probably one for UDP, too). ...


2

While both methods might look similar, they are entirely different technically. A proxy accepts a socket connection and fulfills the client request in some way or other. Usually, it creates its own request to the indicated server. The by far most common example is an HTTP proxy that accepts HTTP requests from clients, uses its own HTTP request to retrieve ...


2

You'll have to use some sort of tunnel here. Option A would be setting up openVPN on your VPS and then connect both clients (home & work) to it. OpenVPN is quite stable and usually reconnects quickly after an interruption (e.g. ISP initiated an IP change). Option B would be building an SSH tunnel with the VM acting as some sort of bridge. SSH tunnels ...


1

As Zac67 says, there's no such thing as "normal proxy" as anything can be proxied but with "normal" proxy usually people refer to http proxy. Also this does go beyond the scope of this forum. But shortly the difference is the protocol used between the client and the proxy server. The question is discussed for example this Stackoverflow ...


1

ISP proxies are used by mass mailers, scammers and other ne'er-do-wells to appear to be residential users when sending out their data. The idea is to make it harder for spam filters and blacklists to block them. Do you really want them as a customer?


1

A virtual private network is an encrypted connection that serves as a virtual link. It is called a tunnel because the 'inner' user network packets are (again) encapsulated in 'outer' transport packets that run between the tunnel ends. The inner packets emerge at the far tunnel end exactly as they've entered it. They see the arbitrarily long outer VPN path as ...


1

You only require a reverse proxy if the destination is to be selected based on application-layer information. E.g. you can use a reverse proxy to make multiple HTTP servers accessible through a single (public) TCP port; the proxy then forwards to the actual server based on the ''host'' tag. Of course, you can make the proxy accessible from the Internet using ...


1

You should not use interface address for NAT, use some virutal address outside static NAT should be configured differently I repeated your ip address configuration and topology, but my NAT rules are: ip nat inside source static 10.1.1.2 20.1.1.100 ip nat outside source static 20.1.1.2 20.1.1.100 then when we ping 20.1.1.2 from 10.1.1.2 we have on the ...


1

You are correct, the IP addresses will be replaced by the sending and receiving SIP proxy server IP address for that leg of session, although this isn't NAT as they are actually separate IP/UDP sessions. SIP packets aren't treated any differently by routers, and if a packet needs to be routed between networks it will be forwarded with the source and ...


1

To get traffic from one VLAN to another VLAN requires a router to route packets between the VLANs. Having both VLANs attached to a router will, by default, route traffic between the VLANs. If you want to restrict the traffic in any way, then you use access lists to permit the traffic you want, and block the traffic you do not want.


1

Your problem will be that the transport layer protocols will need to be fixed, too. For example, TCP has a checksum that is predicated on the pseudo-header that includes the IP source and destination addresses. Your web browsing will need to use TCP, so you will need to fix the TCP headers. See RFC 793, Transmission Control Protocol: Checksum: 16 bits The ...


1

The errors in the logs concern a DNS connection (port 53) towards OpenDNS servers (208.67.222.222 and 208.67.220.220). It appears that these servers are not reachable from your proxy machine. The issues with websites not loading aren't due to the websites themselves, but to the fact that your proxy is unable to resolve the domain name of the URL to an IP ...


1

It works because you aren't asking to youtube from the proxy; you're requesting some other site, that then sends you to youtube. (aka a "VPN", or "tunnel")


1

If all your trying to do is block certain websites you can do that much easier with a Host file. I would recommend a pc instead of a pi but here is the gist of things. Take your pi and get a wifi card. Connect the pi to the wifi and make sure it has internetz. Then attach your ubuntu pc to the pi using a ethernet cable. Install and setup a transparent ...


1

Go to your edge-router/firewall. Block the Ubuntu system from having access to TCP 80 and 443. Permit the proxy server to access TCP 80 and 443. Then the Ubuntu system will only work when it access the proxy. The admin can of course change the config, but then they get NO web access. Setup up the rest (access to the web server, sshd etc on the Ubuntu) ...


1

The simplest way would be to allow one PC to go directly to the Internet, bypassing the proxy, and then compare that to using the proxy. Make several connections to account for momentary congestion somewhere. Another idea: check the interface counters on your switches and look for output drops. Sometimes, perceived "slowness" while browsing the Internet ...


Only top voted, non community-wiki answers of a minimum length are eligible