I’m currently working on setting up a proxy on my home computer to bypass my school’s blockers, and want to see if I can make any improvements to security. To be clear, I haven’t opened this to the internet yet, I’m asking BEFORE doing that.

The setup is thus: I have a squid server running on my linux laptop, which will only allow authenticated users through. It’s no longer listening to the default port (3128) and is instead listening to a port in the 10000-20000 range. I would have both my router and modem set to forward that same port, and my laptop’s local IP address is static.

This is a consumer internet connection, so Dynamic DNS, but I have a NOIP address ready to connect once I open the ports (already have the client installed and running, just throws an error on the website because it can’t get through the port.)

I’ll be connecting to my proxy server through the FoxyProxy extension, rather than through the Windows 11 control panel on my school laptop, because I dont have access to that specific part of the control panel.

That’s the sum total of the setup I’ve got thus far. It only needs to be able to support my lone connection, I’m not sharing this around. Any improvements to be made?

  • keisatsu@infosec.pubEnglish
    0·
    1 month ago

    I would be hesitant to put a squid proxy directly on the Internet as there is a history of vulnerabilities in that software and afaik a bunch of them are yet to be fixed.

    First of all I would advise against trying to bypass the security controls your school implemented, but if I hypothetically would attempt to do what you’re trying I would probably set up a haproxy on a dedicated piece of hardware, such as a raspberry pi, and expose 443 to the Internet. I would configure a simple static website to serve as default, and add a ssh backend like in this guide: https://www.haproxy.com/blog/route-ssh-connections-with-haproxy

    Now you can SSH to your backend by wrapping the connection with openssl s_client. From here you can do a dynamic port forwarding, which essentially acts as a socks proxy and finally connect to that with firefox

    edit: slap a tls cert on that too for good measure. Helps with hiding the ssh traffic