If anyone's ever looking for an even quicker hack, ssh has built-in the ability to act as a SOCKS5 proxy, tunneling your traffic over ssh to whatever remote machine you might have access to:
$ ssh -D 1080 myserver.myhost.net
Then configure Chrome or Firefox or whatever to use a SOCKS5 proxy on localhost, port 1080. (N.B. that this does not tunnel DNS lookups by default.)
The OpenVPN-based route is the way to go for something used regularly, but the above is sometimes super-convenient!
I think the fact that this leaks DNS lookups is really quite key because that gives away a huge amount about what you're looking at over your "vpn", not to mention services like netflix that are pointing you to different responses based upon the source of your dns lookups.
In firefox you want to go to about:config page and turn on network.proxy.socks_remote_dns
I believe that Mac OS X does tunnel DNS when you configure the proxy through Control Panel -> Network. I used this when I was in the Army and lived in housing whose internet connections were managed by a crappy ISP that did DNS-based filtering of sites they deemed objectionable.
I'm using the latest stable release of Firefox (34.0.5) and I see a "Remote DNS" checkbox under my SOCKS proxy configuration. Isn't that the same option in the GUI? No about:config tweaks needed?
I would think so, but everyone seems to be giving the about:config business, so maybe I am missing something.
Yes, that is the same option. Toggling the option in the GUI toggles network.proxy.socks_remote_dns in about:config. As default it is, is still off though.
Nice! I've been using dnsmasq to route my DNS queries and prevent leakage. Didn't realize the nework.proxy.socks_remote_dns option existed. Thanks for sharing!
Even better trick is SSH can actually tunnel level 3 data! Via TUN/TAP interfaces (this is effectively how some VPN implementations do it).
See "-w" option
Here are a few guides. This is more involved than just adding the -D option and setting a "proxy" field in some applications but this is more general as well:
SSH does it's own flow control, and with HPN-SSH it is much better.
Also, if your connection to the VPN host is quite good, then the TCP-over-TCP issue does not apply as much. The bad cases happen when that connection has packet loss.
Even quicker still is to use sshuttle; it automatically transparently tunnels all of your traffic through an SSH connection, without having to change any proxy settings.
Agreed, I set myself up an OpenVPN server on digitalocean without too much of a hassle. The easy-rsa utilities make the whole process quite simple. It has frankly been a life saver for me, as it allows me to bypass all restrictions imposed where I live (Oman).
Ah yes, ssh tunneling. The high school IT initiate's go-to method to dodge the web filter. It really can be an elegant solution when you don't have the patience to rev up OpenVPN for real.
You could configure a transparent proxy with Privoxy set to use a custom dns server with dnsmasq and foxy-proxy to configure firefox to use that to forward dns request through your proxy.
$ ssh -D 1080 myserver.myhost.net
Then configure Chrome or Firefox or whatever to use a SOCKS5 proxy on localhost, port 1080. (N.B. that this does not tunnel DNS lookups by default.)
The OpenVPN-based route is the way to go for something used regularly, but the above is sometimes super-convenient!