3

I have a network location set up to ssh tunnel to my server. For now, just ssh -D type stuff. This works fine. I set up the tunnel from within my .screenrc. In other words, "screen" is the trigger to connect to my proxy. Before I type that I should not be able to go online. However, lynx and ping go through without problems. tunnel or not. This is disquieting.

How can I ensure all network traffic uses my Network settings, and not it's own? The only way packets should be leaving is via my DynamicForward port.

EDIT: The apple specificity comes with the Network settings, either accessed via System Preferences, or via networksetup.

OS X has both ipfw, and the application level firewall.

The appfirewall does not seem to stop things from going out. It stops connections to the system.

Ipfw does take precedence over the application firewall, apparently.

My SOCKS5 proxy is set up on a port, and I then give that port to in a network Location as the SOCKS5 proxy. This works fine. As I see it, programs should not get a choice about using the proxy, and indeed, if I turn it off, browsers can not access the web.

Linux and *BSD's do not have the various ( quite nifty ) things that OSX has in this regard. For them, it would be ipchains and ipfw, respectively.

I think I'm missing something. It should just work.

Improve this question
6
  • can you filter at the level of your router?
    – Robert S Ciaccio
    Commented Nov 10, 2010 at 21:05
  • also, you may have a better chance with this question on unix.se, superuser, or serverfault. It's not really apple specific so I'd actually propose that this is an off-topic/outside-scope question. However, close voting is disabled due to the open bounty.
    – Robert S Ciaccio
    Commented Nov 10, 2010 at 21:10
  • @calavera While I agree he might have better luck getting an answer on some of those sites and that there's nothing Apple specific about this question, the programs he mentions (with the exception of lynx) do ship with a Mac so it's not strictly off topic.
    – Kyle Cronin
    Commented Nov 10, 2010 at 21:23
  • @Kyle: true enough, I mostly was worried about whether he'd get a good answer on here or not. please see: meta.apple.stackexchange.com/questions/176/…
    – Robert S Ciaccio
    Commented Nov 10, 2010 at 23:43
  • @calavera, I am using an Airport Express router.
    – chiggsy
    Commented Nov 12, 2010 at 5:05

2 Answers 2

Reset to default
3
+25

Assuming that ssh is running on localhost (or another machine on the local subnet), the easiest thing to do is to shut down your routes so that nothing can get outside. netstat -nr will show you your current routes. Mine looks like this:

Internet:
Destination        Gateway            Flags    Refs      Use  Netif Expire
default            192.168.0.69       UGSc       93     4438    en1

192.168.0.69 is my default route. If I take that route out: route delete default 192.168.0.69 then I cannot get to any machine not wired to my network. Once screen sets up your proxy, you should have access back.

Improve this answer
1
  • Note that commands may be different in Linux/Unix. OSX is a bit different in this area.
    – Jack M.
    Commented Nov 10, 2010 at 21:24
1

You may want to have a look at man networksetup to see if it could give you what you are looking for.

Improve this answer
2
  • 1
    This is probably more of a comment than an answer.
    – Jeff Swensen
    Commented Nov 13, 2010 at 3:31
  • I knew about networksetup... tricky issue though, networksetup seems to be a command line interface to similar functions to the gui. I'll have to run opensnoop to be sure, running strings implies that it is a level higher than the "kill switch", that route is.
    – chiggsy
    Commented Nov 16, 2010 at 6:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .