2

I have followed a tutorial here: http://ebnj.net/sshoverdns/

This tutorial tells us how to carry all internet traffic via DNS tunnel if your airport enables no-limit outgoing DNS.

This guides us to host a DNS service on host machine and connect to the host from client on SSH tunneling.

I have tested this on a VPS server and it works like a charm. Both the DNS server and client work very well. There is a DNS service running on port 0.0.0.0:53 on server and a proxy running on port 127.0.0.1:7070 (socks5) on local client machine.

But when I was testing on a client physcially in mainland of China, it failed to negotiate with the DNS service on VPS for tunneling.

ssh -ND 7070 -o ProxyCommand="./droute.pl sshdns.mydomain.ga" myvpsuser@localhost -v

Debug:

OpenSSH_6.6.1, OpenSSL 1.0.1f 6 Jan 2014
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Executing proxy command: exec ./droute.pl sshdns.xigua.ga
debug1: identity file /home/myname/.ssh/id_rsa type 1
debug1: identity file /home/myname/.ssh/id_rsa-cert type -1
debug1: identity file /home/myname/.ssh/id_dsa type -1
debug1: identity file /home/myname/.ssh/id_dsa-cert type -1
debug1: identity file /home/myname/.ssh/id_ecdsa type -1
debug1: identity file /home/myname/.ssh/id_ecdsa-cert type -1
debug1: identity file /home/myname/.ssh/id_ed25519 type -1
debug1: identity file /home/myname/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.7
debug1: permanently_drop_suid: 1000

When I was testing on uncensored Internet in the U.S., it will not be stuck here. It would tell me to input password for user myvpsuser.

It seems that the Chinese GFW has censored and blocked the SSH or DNS traffic.

If this has nothing to do with the DNS service, can we pass the Internet traffic via another proxy instead of the one created by SSH service? Or what else can I do to solve this?

  • It is well know that GFW does DNS poisoning. It is also possible that the airport wifi return false DNS records. Have you verified that "your airport enables no-limit outgoing DNS." – billc.cn Jun 2 '16 at 16:19
  • @billc.cn The DNS record returned was right from my VPS server. I verified it enabled. This tunneling does not work in mainland of China but other countries. Need another solution. – dotslash Jun 3 '16 at 8:21
  • @dotslash "Need another solution." Stackexchange is not the place to seek recommendations, you are turning this into an opinion-based question. – Little Code Jun 15 '16 at 8:06
  • @LittleCode If you have recommendations, please leave yours here. The phrase "Need another solution" may refer to the condition that if you can not leave any recommendation. Thanks. – dotslash Jun 16 '16 at 10:55
  • @dotslash you don't get it ! Stackexchange is not the place for recommendations, and that is the type of "answer" you are clearly seeking. But everyone will have a different recommendation, i.e. different opinion i.e. it is an opinion based question therefore not suited to stackexchange. – Little Code Jun 16 '16 at 11:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.