sorry to bother,
im trying to make older browsers be able to display TLS 1.1 and TLS 1.2 sites.
i heard stunnel cant be configured to always forward to the current
site address dynamically, thats why i would use privoxy.
the browser is configured to send to:
127.0.0.1 443
stunnel config has this at the end:
[Tunnel_in]
client = yes
accept = 127.0.0.1:443
connect = 127.0.0.1:8118
verifyChain = yes
CAfile = ca-certs.pem
checkHost = localhost
127.0.0.1:8118 is the privoxy address.
this is what stunnel writes:
LOG5[main]: Configuration successful
LOG5[0]: Service [Tunnel_in] accepted connection from 127.0.0.1:3261
LOG5[0]: s_connect: connected 127.0.0.1:8118
LOG5[0]: Service [Tunnel_in] connected remote server from 127.0.0.1:3262
and the browser infinitely loads, and never loads anything or leaves the page.
if i remove the last 3 lines, its the same just with this line added:
LOG4[main]: Service [Tunnel_in] needs authentication to prevent MITM attacks
but it doesnt give an error or anything.
with a configuration like:
[Tunnel_out]
client = no
accept = 127.0.0.1:443
connect = 127.0.0.1:8118
cert = stunnel.pem
this is what it gives:
LOG5[3]: Service [Tunnel_out] accepted connection from 127.0.0.1:3294
LOG3[3]: SSL_accept: 1407609B: error:1407609B:SSL
routines:SSL23_GET_CLIENT_HELLO:https proxy request
LOG5[3]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket
and browser gives a server not found error immediately. im not even
sure if i should use client or server configuration in a case like
this, but none of them works anyway. all i would need is for my
browser to get the pages decrypted, or at least in less than TLS1.1.
like how on newipnow.com i can access sites with any encryption, since
they are sent to the browser without encryption. the browser just
gives an "unencrypted tunnel" warning, which is how i found stunnel,
and which is exactly what i need, just locally.
Hi,
Can you help me how to configure stunnel client to use TPM for mutual TLS authentication? I want to connect with mTLS to a remote server then make this connection available for localhost without mTLS.
Thanks for your help in advance!
Here is my configuration so far without TPM:
debug = debug
output = /tmp/stunnel.log
foreground = yes
[mtls_client]
client = yes
accept = 127.0.0.1:12019
sni = server-with-mtls.example.com
checkHost = server-with-mtls.example.com
connect = 1.2.3.4:443
verifyChain = yes
CApath = /etc/ssl/certs/
cert = client.crt
key = client.key
Thanks & br,
Gábor Nyíri,
Hi all,
To make "Stunnel 5.31" work with Gmail, I have to go in security settings
of Gmail and "allow less secure apps to access my account".
Is it mandatory ?
Is it possible to set Stunnel to access Gmail without lowering it security
level ?
How ?
I checked in log file TLS v1.2 is used by Stunnel but Gmail still consider
it as a "less secure app." !
Regards,
Steve
Hi everyone,
I want to do some processing over the incoming connection before forwarding
the payload to the uplinks. ie. Listen <-> customized processing <-> connect
Is there any API/hook structure to write my logic in a clean fashion? Or
need to add/integrate my codes to the Stunnel codes?
P.S I want this processing to be done in Stunnel and not by adding a 2nd
application to achieve the job.
Thanks
Ray
Greetings!
I tried building stunnel in my mac and it was successful since I have all
the developer tools installed.
What about for those who do not have an 8GB size tool? Is there a way I can
simply build a binary that can work in a wide range of macOS versions
(including older ones)? Is there someone who has already done this?
Any pointers in this regard would be greatly appreciated!
--
Shrinidhi S Rao
Hello list,
I've successfully managed to setup the following:
client -> stunnel (local on client) -> stunnel (on server) -> squid
(same server)
I was wondering however if it would be possible to NOT use stunnel on
the client side and connect directly to the server side one.
My current, working configs are below.
simplified server side stunnel.conf:
cert = /etc/stunnel/stunnel.pem
debug = 7
output = /var/log/stunnel.log
client = no
[squid]
accept = 3128
connect = 127.0.0.1:3129
client side config:
cert = /etc/stunnel/stunnel.pem
client = yes
[squid]
accept = 127.0.0.1:8080
connect = server:3128
On the server side, I've tried specifying:
client = yes
protocol = connect
protocolHost = 127.0.0.1:3129 #SSL terminates on the stunnel server
(still unsure about this)
but because the proxy needs authentication (it used LDAP), I'm hitting
what seems to be stunnel not returning the HTTP407 back to the client.
2020.03.13 20:18:34 LOG6[12306:140677061584640]: Client-mode connect
protocol negotiations started
2020.03.13 20:18:34 LOG7[12306:140677061584640]: -> CONNECT
127.0.0.1:3129 HTTP/1.1
2020.03.13 20:18:34 LOG7[12306:140677061584640]: -> Host: 127.0.0.1:3129
2020.03.13 20:18:34 LOG7[12306:140677061584640]: ->
2020.03.13 20:18:34 LOG7[12306:140677061584640]: <- HTTP/1.1 407
Proxy Authentication Required
2020.03.13 20:18:34 LOG3[12306:140677061584640]: CONNECT request rejected
2020.03.13 20:18:34 LOG7[12306:140677061584640]: <- Server: squid/3.5.20
2020.03.13 20:18:34 LOG7[12306:140677061584640]: <- Mime-Version: 1.0
2020.03.13 20:18:34 LOG7[12306:140677061584640]: <- Date: Fri, 13 Mar
2020 20:18:34 GMT
2020.03.13 20:18:34 LOG7[12306:140677061584640]: <- Content-Type:
text/html;charset=utf-8
2020.03.13 20:18:34 LOG7[12306:140677061584640]: <- Content-Length: 3431
2020.03.13 20:18:34 LOG7[12306:140677061584640]: <- X-Squid-Error:
ERR_CACHE_ACCESS_DENIED 0
2020.03.13 20:18:34 LOG7[12306:140677061584640]: <- Vary: Accept-Language
2020.03.13 20:18:34 LOG7[12306:140677061584640]: <- Content-Language: en
2020.03.13 20:18:34 LOG7[12306:140677061584640]: <-
Proxy-Authenticate: Basic realm="myproxy"
2020.03.13 20:18:34 LOG7[12306:140677061584640]: <- X-Cache: MISS from myproxy
2020.03.13 20:18:34 LOG7[12306:140677061584640]: <- X-Cache-Lookup:
NONE from myproxy:3129
2020.03.13 20:18:34 LOG7[12306:140677061584640]: <- Via: 1.1 myproxy
(squid/3.5.20)
2020.03.13 20:18:34 LOG7[12306:140677061584640]: <- Connection: keep-alive
2020.03.13 20:18:34 LOG7[12306:140677061584640]: <-
2020.03.13 20:18:34 LOG5[12306:140677061584640]: Connection reset: 0
byte(s) sent to SSL, 0 byte(s) sent to socket
I'm testing with the following command from the client side: curl -U
mysuer -x http://myproxy:3128https://www.google.com
Any help would be greatly appreciated.
Hi Kelly.
>>Connect = 127.0.0.1:1194? ?#<- this line won't work; but if I replace with 1.2.3.4:1194 then it will work!
Generic:
The following layers maybe helpful: Cost / People / Process / Infrastructure / Application / Data / Interface ...
Specific:
Data layer (metadata &/| configuration):
Can you please verify that 127.0.01:1194 is present?
e.g. netstat -ano | egrep -e Proto -e Active -e 1194
Message: 1
Date: Tue, 10 Mar 2020 13:25:33 +0800
From: Kelly Trinh <kelly(a)trinhonline.com>
To: "stunnel-users" <stunnel-users(a)stunnel.org>
Subject: [stunnel-users] behaviour when using 127.0.0.1 in the
'connect' field
Message-ID:
<170c2e7c29d.e9c53ed9127299.5279211261811289922(a)trinhonline.com>
Content-Type: text/plain; charset="utf-8"
Hi all - just want to report a problem I solved recently but wanted to get some insights on what was causing the problem.
About me - learnt some unix at university (20 years ago) but nothing too serious.? Recently (1 month ago) acquired own domain name and now poking around the cloud computing / VPS thing.
Project - hand-rolling my own VPN setup on a Ubuntu 18.04 VPS.? OpenVPN is easy since it is a git-clone thing and then just follow the openvpn-install script.? I wanted to add on the Stunnel wrapper because intended to use the VPN in China and apparently their firewall does deep packet inspection and can recognize (and block) openvpn traffic.
Problem - when I set up my stunnel using 127.0.0.1 as the connect destination; it doesn't seem to work (I can see from openvpn window that things seem to pipe through stunnel but then immediately the connection is terminated).? If I replace the 127.0.0.1 with IP of the box I am using (say for example 1.2.3.4); everything works!? The FQDN is ok as well; as long as I don't use 127.0.0.1
Specifically the stunnel.conf:
[OpenVPN]
Accept = 443? # clients connect through 443 to further avoid potential blocking
Connect = 127.0.0.1:1194? ?#<- this line won't work; but if I replace with 1.2.3.4:1194 then it will work!
Question - My problem is fixed but I am curious if there is any insights on why this is happening given that 1.2.3.4 and 127.0.0.1 are the same machine?
Hi all - just want to report a problem I solved recently but wanted to get some insights on what was causing the problem.
About me - learnt some unix at university (20 years ago) but nothing too serious. Recently (1 month ago) acquired own domain name and now poking around the cloud computing / VPS thing.
Project - hand-rolling my own VPN setup on a Ubuntu 18.04 VPS. OpenVPN is easy since it is a git-clone thing and then just follow the openvpn-install script. I wanted to add on the Stunnel wrapper because intended to use the VPN in China and apparently their firewall does deep packet inspection and can recognize (and block) openvpn traffic.
Problem - when I set up my stunnel using 127.0.0.1 as the connect destination; it doesn't seem to work (I can see from openvpn window that things seem to pipe through stunnel but then immediately the connection is terminated). If I replace the 127.0.0.1 with IP of the box I am using (say for example 1.2.3.4); everything works! The FQDN is ok as well; as long as I don't use 127.0.0.1
Specifically the stunnel.conf:
[OpenVPN]
Accept = 443 # clients connect through 443 to further avoid potential blocking
Connect = 127.0.0.1:1194 #<- this line won't work; but if I replace with 1.2.3.4:1194 then it will work!
Question - My problem is fixed but I am curious if there is any insights on why this is happening given that 1.2.3.4 and 127.0.0.1 are the same machine?
