Yes, I know I fit the cliche here, but I like to work outside my office in a coffee shop or another public location. It’s a good feeling to have some people around instead of seeing the same faces all day long – or even no faces when you’re a lonesome freelancer like me ;) However, there are two drawbacks I was never happy with: First almost all public WLAN hotspots are unencrypted, which is quite a security problem, and second some networks don’t allow the use of certain services (e.g. the network at my university doesn’t allow me to send emails via secure SMTP). Luckily the solution to this problem is quite simple: We need a local SOCKS5 proxy that routes all internet traffic through a secure SSH tunnel.
All you need is a working Mac OS X, my WiFiTunnel script (Installer or ZIP archive) and a SSH Server outside of your local network. No idea where to get such a server? Well, there are some public SSH servers out there, but almost all virtual server packages offer SSH, so just try to connect to a server that hosts one of your websites. All necessary details are explained during the script installation, but you should read on if you want to get the whole story.
How to use WiFiTunnel?
Installing and using WiFiTunnel is pretty easy:
- Download the WiFiTunnel Installer Package
- Open the package to install WiFiTunnel
- Open a terminal (/Applications/Utilities/Terminal)
wifitunnel --on user@hostnameto open the tunnel
wifitunnel --offto close the tunnel
- Read the man page (
man wifitunnel) for more details.
If don’t want to use an installer you can also download the ZIP archive and follow the instructions in the readme.
What does WiFiTunnel?
OpenSSL comes with OSX, so there is no need to install anything to secure your connection. WiFiTunnel is nothing more but a bash script for convenience, which does the following tasks:
- Establishing a SSH tunnel to a server outside of the local network
- Configuring SSH to act as a SOCKS proxy
- Configuring the active system networks to use this proxy
- Sending keep alive requests while connected
- Disable the SOCKS proxy in the system network settings
- Shutting down the SSH tunnel
Steps 1 to 3 are executed after entering
wifitunnel --on user@hostname in the terminal, step 4 runs as long as the connection is active and the steps 5 and 6 are executed after a
What is done in what step?
Step 1 and 2 are done with one command:
ssh -f -N -D 127.0.0.1:$PORT $HOST
This establishes a SSH tunnel to
$HOST (user@hostname) where
-N prevents the execution of any commands through this connection. The
-D switch tells SSH to act as a SOCKS5 proxy server on port
$PORT (default is 1080) of the local host (which IP address is 127.0.0.1). Finally
-f forces SSH into the background after the connection has been established.
Next we edit the network settings in step 3:
networksetup -setsocksfirewallproxy $SERVICE 127.0.0.1 $PORT off networksetup -setsocksfirewallproxystate $SERVICE on
$Service is the name of the network interface we’re using, usually
Ethernet. The first command sets the SOCKS proxy parameters for the interface and the second enables the proxy. It’s basically the same as configuring the network through the System Preferences.
Step 4 keeps the connection alive:
curl -s http://www.google.com > /dev/null
Some public wireless hotspots close the connection if there is not traffic on port 80, so I added a keep-alive option to WiFiTunnel that requests the Google startpage every 3 minutes. We don’t need the result so we send everything to
Disabling the SOCKS proxy – step 5:
networksetup -setsocksfirewallproxystate $SERVICE off
And finally step 6:
This terminates the proxy server.
$PID is the process id of the SSH call we made in step 1, you can see it when you enter p
s ax | grep ssh in the terminal.
This is my first bash script ever so I’m pretty sure there are some bugs in it, but I hope you find it useful anyway. I’m always happy about feedback, especially bug reports (and fixes ^^).