Bounce proxy penetrating the Intranet

Bounce proxy penetrating the Intranet

The roommate has gone out for an internship and has to choose a course again. The school's educational administration system does not seem to be accessible from the Internet, so we will consider providing them with a proxy.

In general, the proxy server needs to run on the Intranet, and the access port is exposed on the public network boundary for Internet users to access. However, it is clear that I do not have the permission to change the firewall.

Fortunately, I have a VPS. In the case that users on both sides cannot directly connect to each other, I can only use the third server for the transfer. The idea is very direct. the proxy of the school network actively connects to the intermediate server, and then the intermediate server provides the proxy service to receive requests and forward them to the proxy server of the school network.

This method is called "bounce proxy ".

I. Build a 5 rebound proxy

I searched the internet and found a software ssocks that supports the rebound proxy. Download and compile.

Port 8888 is opened on VPS to rebound proxy connections, and port 1080 provides the Sock5 proxy service:

Shell

./rcsocks -l 1080 -p 8888 -vv

./rcsocks-l1080-p8888-vv

When you use Raspberry Pi to set up a rebound proxy client on the school network, it automatically connects to port 8888 of VPS at startup:

Shell

./rssocks -vv -s bakachu.cn:8888

./rssocks-vv-sbakachu.cn:8888

 

In this way, the proxy is set up, and then you only need to use the proxy client to connect to port 1080 of VPS to obtain the service.

2. Convert to HTTP Proxy

However, the Sock5 proxy function is too powerful. If only the HTTP proxy service is provided, the conversion is required. Here, I directly use tengine and the lua module on it to write a small conversion script to transfer the HTTP request to the local sock5 proxy.

Tengine Configuration:

server {listen 8080;server_name proxy.bakachu.cn;charset utf-8;access_log /home/ngx-logs/proxy.access.log;error_log /home/ngx-logs/proxy.error.log;location / {lua_socket_read_timeout 300s;default_type text/html;content_by_lua_file /data/proxy.lua;}}

Lua script:

Lua

local socks5 = require("resty.socks5")local base64 = require("base64")local headers = ngx.req.get_headers()local proxy_auth = headers["Proxy-Authorization"]if proxy_auth == nil or proxy_auth == "" thenngx.header["Proxy-Authenticate"] = 'Basic realm="Passwd required."'ngx.exit(407)elselocal _, _, base64enc = string.find(proxy_auth, "Basic (.+)")local authinfo = base64.decode(base64enc)local _, _, username, passwd = string.find(authinfo, "(.+):(.+)")if username ~= "proxy_username" or passwd ~= "proxy_passwd" thenngx.header["Proxy-Authorization"] = ""ngx.header["Proxy-Authenticate"] = 'Basic realm="Bad username or password."'ngx.exit(407)elsesocks5.handle_request("127.0.0.1", 1080)endend

In this way, you can access the sock5 proxy through http://proxy.bakachu.cn: 8080 and the user name and password.