Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

I have a network location set up to ssh tunnel to my server. For now, just ssh -D type stuff. This works fine. I set up the tunnel from within my .screenrc. In other words, "screen" is the trigger to connect to my proxy. Before I type that I should not be able to go online. However, lynx and ping go through without problems. tunnel or not. This is disquieting.

How can I ensure all network traffic uses my Network settings, and not it's own? The only way packets should be leaving is via my DynamicForward port.

EDIT: The apple specificity comes with the Network settings, either accessed via System Preferences, or via networksetup.

OS X has both ipfw, and the application level firewall.

The appfirewall does not seem to stop things from going out. It stops connections to the system.

Ipfw does take precedence over the application firewall, apparently.

My SOCKS5 proxy is set up on a port, and I then give that port to in a network Location as the SOCKS5 proxy. This works fine. As I see it, programs should not get a choice about using the proxy, and indeed, if I turn it off, browsers can not access the web.

Linux and *BSD's do not have the various ( quite nifty ) things that OSX has in this regard. For them, it would be ipchains and ipfw, respectively.

I think I'm missing something. It should just work.

share|improve this question
    
can you filter at the level of your router? –  Robert S Ciaccio Nov 10 '10 at 21:05
    
also, you may have a better chance with this question on unix.se, superuser, or serverfault. It's not really apple specific so I'd actually propose that this is an off-topic/outside-scope question. However, close voting is disabled due to the open bounty. –  Robert S Ciaccio Nov 10 '10 at 21:10
    
@calavera While I agree he might have better luck getting an answer on some of those sites and that there's nothing Apple specific about this question, the programs he mentions (with the exception of lynx) do ship with a Mac so it's not strictly off topic. –  Kyle Cronin Nov 10 '10 at 21:23
    
@Kyle: true enough, I mostly was worried about whether he'd get a good answer on here or not. please see: meta.apple.stackexchange.com/questions/176/… –  Robert S Ciaccio Nov 10 '10 at 23:43
    
@calavera, I am using an Airport Express router. –  chiggsy Nov 12 '10 at 5:05
show 1 more comment

2 Answers 2

up vote 3 down vote accepted
+25

Assuming that ssh is running on localhost (or another machine on the local subnet), the easiest thing to do is to shut down your routes so that nothing can get outside. netstat -nr will show you your current routes. Mine looks like this:

Internet:
Destination        Gateway            Flags    Refs      Use  Netif Expire
default            192.168.0.69       UGSc       93     4438    en1

192.168.0.69 is my default route. If I take that route out: route delete default 192.168.0.69 then I cannot get to any machine not wired to my network. Once screen sets up your proxy, you should have access back.

share|improve this answer
    
Note that commands may be different in Linux/Unix. OSX is a bit different in this area. –  Jack M. Nov 10 '10 at 21:24
add comment

You may want to have a look at man networksetup to see if it could give you what you are looking for.

share|improve this answer
1  
This is probably more of a comment than an answer. –  Jeff Swensen Nov 13 '10 at 3:31
    
I knew about networksetup... tricky issue though, networksetup seems to be a command line interface to similar functions to the gui. I'll have to run opensnoop to be sure, running strings implies that it is a level higher than the "kill switch", that route is. –  chiggsy Nov 16 '10 at 6:59
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.