Create own proxy server on FreeBSD using Stunnel and 3proxy software with public key cryptography verification between the Stunnel server and Stunnel.

[ZgNZXxBPdAu5m2kcL]

This topic provides a solution on how to make own Proxy serwer, on a FreeBSD operating system, using Stunnel validated with public-key cryptography between Stunnel server and Stunnel client, for use by a web browser. The primary benefit is that, unlike other VPN, the client does not require administrator privileges for working. This type of network can be with entry, for example, at airports or in an Internet cafe, or anywhere where firewalls and security policies filter traffic. The service used to create the SOCKS5 proxy is net/3proxy, also known as threeproxy. The program used to tunnel the traffic is security/stunnel. security/OpenSSL was used to generate the keys. The principle of operation is based on encrypting the traffic between the client and the stunnel server, then the decrypted traffic locally on the FreeBSD server "falls" into the 3proxy and flies further into the world. SSL encryption (especially on port 443) prevents automatic firewall traffic blocking.

1. Installs needed packages from ports.

root@router:~ # pkg install openssl

root@router:~ # pkg install 3proxy

root@router:~ # pkg install stunnel

2. After installing the packages, go to their configuration.

The stunnel configuration file is located in:

/usr/local/etc/stunnel/stunnel.conf

Whereas 3proxy is located in:

/usr/local/etc/3proxy.cfg

3. Let's start with Stunnel Server.

The configuration of this program should include:
ee /usr/local/etc/stunnel/stunnel.conf

# Global options
# debug = 7
# output = /var/log/stunnel.log

# Service options
[Server]
accept = 443
connect = 127.0.0.1:8282
cert = /usr/local/etc/stunnel/publickey.pem
key = /usr/local/etc/stunnel/privatekey.pem

debug = 7 - It accepts arguments from 0 to 7, where 7 is the highest level of log detail.
output = /var/log/stunnel.log - Log file. Logs are no longer needed so they are bound.
accept = 443 - Listening for incoming connections from outside on port 443.
connect = 127.0.0.1:8282 - Connecting via localhost to the 3proxy server, on port 8282 where the proxy server will be listening.
cert = /usr/local/etc/stunnel/publickey.pem - Location of the public key.
key = /usr/local/etc/stunnel/privatekey.pem - Location of the private key.

4. Generating self-signed certificates using OpenSSL.

Navigating to /usr/local/etc/stunnel/ folder.

cd /usr/local/etc/stunnel/

Once there, should to start generating certificates. To do this, first generate a private key with name privatekey.pem.

root@router:/usr/local/etc/stunnel # openssl genpkey -algorithm RSA -out privatekey.pem

Generating a certificate based on a private key. Fields for entering information such as country code, city, company, etc. will be displayed. For home/private use, is possible to leave the default by clicking enter:

root@router:/usr/local/etc/stunnel # openssl req -new -key privatekey.pem -out certificate.pem

Self-signed certificate (creating a server-signed certificate):

root@router:/usr/local/etc/stunnel # openssl x509 -req -in certificate.pem -signkey privatekey.pem -out publickey.pem

ls -l shows several files. It's not hard to see that the privatekey.pem and publickey.pem files are used by the stunnel server config file and the path to them was given earlier.

root@router:/usr/local/etc/stunnel # ls -l
-rw-r--r--  1 root  wheel   956 Jun 22 08:28 certificate.pem
drwxrwxrwx  2 root  wheel   512 Jun 19 15:06 conf.d
-rw-------  1 root  wheel  1704 Jun 22 08:24 privatekey.pem
-rw-r--r--  1 root  wheel  1123 Jun 22 08:32 publickey.pem
-rwxrwxrwx  1 root  wheel   224 Jun 22 07:10 stunnel.conf
-rwxrwxrwx  1 root  wheel  4633 Mar  7 10:10 stunnel.conf-sample

5. Setting 3proxy to work with password authorization. This password will then be necessary for operation. Will be needed to enter it into web browser. The password is set because the stunnel server listens globally and there would be the possibility of unauthorized common proxy access.

ee /usr/local/etc/3proxy.cfg

daemon
nserver 208.67.222.222

auth strong
users 123:CL:45

socks -i127.0.0.1 -p8282

daemon - This line enables the daemon mode for 3proxy. Run it as a background service.
nserver 208.67.222.222 - Defines the DNS server address that will be used by 3proxy to resolve domain names.
auth strong - Strong authentication for users. Means that 3proxy will require users to authenticate themselves before granting access to the proxy service.
users 123:CL:45 - defines users and their authentication credentials. In this case, a user named "123" with a password of "45" is defined.
socks -i127.0.0.1 -p8282 - This line defines the SOCKS service on port 8282 listening locally.

6. Starting services.

Enable stunnel and 3proxy with commands:

root@router:/usr/local/etc/stunnel # service stunnel onestart
root@router:/usr/local/etc/stunnel # service 3proxy onestart

It should run without errors. Can also add entries to /etc/rc.conf here using sysrc stunnel_enable="YES" and sysrc threeproxy_enable="YES" , which causes the services to start when the system boot.
The operation of the services can be checked with stem commands.

root@router:/usr/local/etc/stunnel # service 3proxy status

Or using the sockstat command as shown in the example:

root@router:/usr/local/etc/stunnel # sockstat -l -4 | grep 8282
root     3proxy     52745 4  tcp4   127.0.0.1:8282        *:*
root@router:/usr/local/etc/stunnel # sockstat -l -4 | grep 443
root     stunnel    1468  10 tcp4   *:443                 *:*

Since when enabled, stunnel works but becomes unresponsive to system commands, so to change the settings, first disable stunnel with pkill stunnel (So that there is nothing in the sockstat command on port 443) And then enable it with #service stunnel start.

7. Client configuration, in the Windows example.

First, download it from somewhere, e.g. from the official stunnel website for the operating system you are using. Installing stunnel from an .exe file to some folder, or installing stunnel at home and transferring it to target computer usfing flash drive or network drive/CD-ROM etc. During the installation, the program will open a cmd console to generate keys using OpenSSL, which will not be used anyway, so we use the default settings by clicking enter.
In the folder C:\Users\yourusername\Desktop\stunnel\config there is a configuration file called stunnel.conf. Delete it or rename it to, for example, stunnel.conf.bac
Create a new configuration file called stunnel.conf About the content:

client = yes

[client]
accept = 127.0.0.1:1080
connect = IPofSERVERPROXY:443

client = yes - Set to run as a client
accept = 127.0.0.1:1080 - Stunnel address and port. The port to which traffic from FireFox will be redirected.
connect = IPofSERVERPROXY:443 - The external IP address of the stunnel server. It can be checked in the command line by:

root@router:/usr/local/etc/stunnel # wget -qO - ifconfig.me ; echo
XXX.XXX.XXX.XXX
root@router:/usr/local/etc/stunnel # curl -s ifconfig.me ; echo
XXX.XXX.XXX.XXX

Static can be obtained from ISP (Internet Software Proider).

Run the program using tstunnel.exe C:\Users\yourusername\Desktop\stunnel\bin\tstunnel.exe. The connection between the tunnels has been established on port 443 and encrypted.

7. Configure FireFox using a browser add-on called FoxyProxy because FoxyProxy allows to enter the proxy server password that was defined at the beginning.

Install FoxyProxy standard from the FireFox store.

FoxyProxy Standard – Get this Extension for 🦊 Firefox (en-US)

Download FoxyProxy Standard for Firefox. FoxyProxy is an open-source, advanced proxy management tool that completely replaces Firefox's limited proxying capabilities. No paid accounts are necessary; bring your own proxies or buy from any vendor. The original proxy tool, since 2006.

addons.mozilla.org

Then in the FoxyProxy menu, is nessesery to press Add button and Add proxy:
Proxy Type - SOCKS5
Proxy IP address or DNS name - 127.0.0.1
Port - 1080
Username - 123
Password - 45
Send DNS through SOCKS5 proxy - On

And press Save. Just like in the picture.


8. In the add-on options in the new tab, is needed to enable the previously defined proxy for all addresses.



9. In the connection option in FireFox main settings, it should be set to "Use system proxy settings" As can be seen, the network connection settings inside FireFox do not give the option to enter a password.



10. At this point Tunnel SSL is properly configured and working.

11. However, if an incorrect login or password is entered in FoxyProxy, will get a message behind "Unable to connect".

 

[ZgNZXxBPdAu5m2kcL]

Because some firewalls blocks the connection using TLS Bumping or some other method.

LOG3[0]: SSL_accept: /usr/src/crypto/openssl/ssl/record/rec_layer_s3.c:1603: error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca
LOG5[0]: Connection reset/closed: 0 byte(s) sent to TLS, 0 byte(s) sent to socket

A simpler and more efficient solution is to use symmetric encryption, by abandoning TLS, and adding the path to the file containing the password to the stunnel configuration file:

#Global options
#debug = 7
#output = /var/log/stunnel.log

# Service options
[Server]
accept = 443
connect = 127.0.0.1:443

ciphers = PSK
PSKsecrets = /usr/local/etc/stunnel/password

Where /usr/local/etc/stunnel/password contains a password in the format user:somepassword.

And for client:

client = yes

[client]
accept = 127.0.0.1:443
connect = IPofSERVERPROXY:443
PSKsecrets = C:\Users\yourusername\Desktop\stunnel\config\password.txt

Encryption is done using most likely AES encryption.

 

[Ome Ko]

Being on the road a lot I every now and then need to tunnel "home" and pretend I sftp from there, since sshd on my servers is tcpwrapped.
I'm running linux on my laptop, so I have 2 lines of code in a script that connects to the server at home on a less orthodox port that I map to port 22 in my modem and from there to the freebsdbox.
It just says

#!/bin/env bash
konsole -e /bin/ssh -D 8080 username@remoteserver.org -pportnumber

This code will open a consolewindow that asks for user's password on remoteserver.org. When a connection is made, all traffic on localhost:8080 is transferred to the remoteserver.
Filezilla (and loads of other applications) can be set up to use a proxyserver using socksv5 on port 8080 so when running this ssh-command everything is encrypted and redirected to my server at home from which I then access my servers.

Same thing can be done on Gates' laptops using Putty; see the howto's elsewhere.