<html><head></head><body>How would connection between stunnel and server through proxy work? To verify servers identity, stunnel needs to receive and verify servers certificate and since servers address is defined in config file, anything that modifies traffic between stunnel and server will be seen as mitm and that will break connectivity.<br>
It might be possible to disable certificate verification, but in that case sslstrip would be better solution. (it would have the same security).<br><br><div class="gmail_quote">On December 9, 2018 3:30:34 PM EET, kovacs janos <kovacsjanosfasz@gmail.com> wrote:<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<pre class="k9mail">i mean a proxy that can work with the address of the actual website<br />opened in the browser, not just specific addresses defined in the<br />config file.<br /><br />at least i thought thats what you meant with this:<br />"In case of client (browser), for each remote (https) server to be<br />connected to, stunnnel config file will need an entry;<br />in browser it will not be possible to use DNS names (all servers will<br />have to be addressed as <a href="http://127.0.0.1">127.0.0.1</a>:someport<br />where "someport", is port assigned in stunnel conf server entry accept<br />statement), so most links in webpages will not work."<br /><br />if stunnel can only work with specified addresses, cant a proxy like<br />privoxy be set up at both ends, and stunnel only has to accept and<br />connect to the address of the proxies?<br /><br />On 12/9/18, Yyy <yyy@yyy.id.lv> wrote:<br /><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;"> What do you mean by dynamic address proxy?<br /><br /> On December 8, 2018 12:39:26 AM EET, kovacs janos<br /> <kovacsjanosfasz@gmail.com> wrote:<br /><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #ad7fa8; padding-left: 1ex;">if stunnel can only accept from and forward to one address, cant that<br />be went around by setting a dynamic address proxy on both sides of<br />stunnel? like:<br />proxy - stunnel - proxy<br /><br />although i havent been able to connect to even a single website, but i<br />didnt try with specifically the IP<br /><br />On 12/7/18, yyy <yyy@yyy.id.lv> wrote:<br /><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #8ae234; padding-left: 1ex;"><br /> ----- Original Message -----<br /> From: "kovacs janos" <kovacsjanosfasz@gmail.com><br /> To: "Flo Rance" <trourance@gmail.com><br /> Cc: <stunnel-users@stunnel.org><br /> Sent: Friday, December 07, 2018 2:30 AM<br /> Subject: Re: [stunnel-users] older browsers, stunnel and privoxy<br /><br /><br /><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #fcaf3e; padding-left: 1ex;"> now im really not sure, since the wikipedia page on stunnel also<br /> describes the program doing exactly what i need in the Example<br /> scenario section:<br /> <a href="https://en.wikipedia.org/wiki/Stunnel#Example_scenario">https://en.wikipedia.org/wiki/Stunnel#Example_scenario</a><br /><br /> "Network traffic from the client initially passes over SSL to the<br /> stunnel application, which transparently encrypts/decrypts traffic<br /></blockquote></blockquote>and<br /><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #8ae234; padding-left: 1ex;"><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #fcaf3e; padding-left: 1ex;"> forwards unsecured traffic to port 25 locally. The mail server sees<br /></blockquote></blockquote>a<br /><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #8ae234; padding-left: 1ex;"><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #fcaf3e; padding-left: 1ex;"> non-SSL mail client. "<br /><br /> only difference is, i need it to forward "unsecured traffic" to my<br /> browser client, not a server. are you all sure its really not<br /> possible?</blockquote><br /> It is possible with the same limitiations as with server case.<br /> In case of server, there is one server, which accepts incoming<br /></blockquote>connections<br /><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #8ae234; padding-left: 1ex;"> (unencrypted) and stunnel accepts unencrypted<br /> connections for that (one) server and decrypts and forwards them.<br /></blockquote>There is<br /><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #8ae234; padding-left: 1ex;"> only one server, which gets connected by stunnel.<br /><br /> In case of client (browser), for each remote (https) server to be<br /></blockquote>connected<br /><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #8ae234; padding-left: 1ex;"> to, stunnnel config file will need an entry;<br /> in browser it will not be possible to use DNS names (all servers will<br /></blockquote>have<br /><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #8ae234; padding-left: 1ex;"> to be addressed as <a href="http://127.0.0.1">127.0.0.1</a>:someport<br /> where "someport", is port assigned in stunnel conf server entry<br /></blockquote>accept<br /><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #8ae234; padding-left: 1ex;"> statement), so most links in webpages will not work.<br /> It may be feasible for small number of servers, which does not links<br /></blockquote>any<br /><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #8ae234; padding-left: 1ex;"> external resources.<br /><br /><hr /><br /> stunnel-users mailing list<br /> stunnel-users@stunnel.org<br /> <a href="https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users">https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users</a></blockquote><br /></blockquote><br /> --<br /> Sent from my Android device with K-9 Mail. Please excuse my brevity.<br /></blockquote></pre></blockquote></div></body></html>