| # Docker-based SSH/SOCKS5 NAT Gateway | |
| This project sets up a Docker-based NAT Gateway using SSH Tunneling and a SOCKS5 proxy on Ubuntu 22.04. It allows you to route traffic from connected clients through the SOCKS5 proxy, which then uses the Docker host's internet connection with NAT. | |
| ## Project Structure | |
| ``` | |
| project-root/ | |
| ├── Dockerfile | |
| ├── docker-compose.yml | |
| ├── entrypoint.sh | |
| ├── ssh-config/ # Contains SSH server configuration and authorized_keys | |
| │ ├── sshd_config | |
| │ ├── authorized_keys | |
| │ └── tunneluser_key # Private key for SSH tunneling (KEEP THIS SECURE!) | |
| │ └── tunneluser_key.pub # Public key for SSH tunneling | |
| └── socks5-config/ # Contains Dante SOCKS5 server configuration | |
| └── danted.conf | |
| ``` | |
| ## Setup Instructions | |
| ### Prerequisites | |
| - Docker installed on your Ubuntu 22.04 host. | |
| - `docker-compose` (version 1.29.2 or later) installed. | |
| - An SSH client on your local machine (e.g., OpenSSH client). | |
| ### 1. Clone the Repository (or create files manually) | |
| If you receive a zip file, extract it. Otherwise, create the `project-root` directory and the files as structured above. | |
| ### 2. Build and Run the Docker Container | |
| Navigate to the `project-root` directory in your terminal and run: | |
| ```bash | |
| sudo docker-compose up --build -d | |
| ``` | |
| This command will: | |
| - Build the Docker image (`ssh-socks-nat-gateway`). | |
| - Start the `nat-gateway` service in detached mode (`-d`). | |
| - Map host port `2222` to container SSH port `22`. | |
| - Map host port `1080` to container SOCKS5 port `1080`. | |
| - Mount the `ssh-config` and `socks5-config` directories into the container. | |
| - Run the container with `NET_ADMIN` and `SYS_MODULE` capabilities and in privileged mode for network manipulation. | |
| ### 3. Verify the Setup | |
| 1. **Check Docker Container Status:** | |
| ```bash | |
| sudo docker ps | |
| ``` | |
| You should see `nat-gateway` running. | |
| 2. **Check Container Logs:** | |
| ```bash | |
| sudo docker logs nat-gateway | |
| ``` | |
| Look for messages indicating: | |
| - "Detected public IP: YOUR_HOST_PUBLIC_IP" (the IP of your host machine) | |
| - "SSH server started." | |
| - "Dante SOCKS5 server started." | |
| - "iptables NAT rules set." | |
| ### 4. Connect and Use the SOCKS5 Proxy | |
| **A. Get your Host's Public IP:** | |
| ```bash | |
| curl ifconfig.me | |
| ``` | |
| Let's assume your host's public IP is `YOUR_HOST_PUBLIC_IP` (e.g., `13.218.209.184`). | |
| **B. Establish an SSH Tunnel (SOCKS5 Proxy) on your Local Machine:** | |
| Open a terminal on your local machine (the one you want to route traffic from) and run the following command. Make sure you are in the directory where `tunneluser_key` is located. | |
| ```bash | |
| ssh -i ssh-config/tunneluser_key -N -D 1080 tunneluser@YOUR_HOST_PUBLIC_IP -p 2222 | |
| ``` | |
| - `-i ssh-config/tunneluser_key`: Specifies the private key for authentication. | |
| - `-N`: Do not execute a remote command (just forward ports). | |
| - `-D 1080`: Creates a dynamic SOCKS5 proxy on your local machine at port `1080`. | |
| - `tunneluser@YOUR_HOST_PUBLIC_IP`: Connects to the SSH server on your Docker host as `tunneluser`. | |
| - `-p 2222`: Specifies the SSH port on your Docker host. | |
| Keep this terminal window open; the SSH tunnel will remain active as long as this command is running. | |
| **C. Configure Your Applications/System to Use the SOCKS5 Proxy:** | |
| Now, configure your applications (e.g., web browser, chat client) or your system's network settings to use a SOCKS5 proxy at `localhost:1080`. | |
| - **Proxy Type:** SOCKS5 | |
| - **Proxy Host/Address:** `127.0.0.1` or `localhost` | |
| - **Proxy Port:** `1080` | |
| Once configured, all traffic from those applications will be routed through the SSH tunnel to your Docker container, and then out to the internet via the Docker host's NAT. | |
| ## Important Notes | |
| - **Security:** Running Docker containers in `privileged` mode and with `NET_ADMIN`/`SYS_MODULE` capabilities grants significant power. Ensure your host system is secure. The `tunneluser_key` is your private key; **keep it secure and do not share it.** | |
| - **IP Forwarding:** The `Dockerfile` and `entrypoint.sh` ensure IP forwarding is enabled and iptables rules are set up for NAT. | |
| - **SOCKS5 vs. VPN:** This setup provides a SOCKS5 proxy, which is application-layer. It's not a full VPN tunnel that routes all system traffic by default. You need to configure applications to use the proxy. For system-wide routing, you might need additional tools (e.g., `proxychains` on Linux/macOS) or system-level proxy settings. | |
| This setup provides a flexible and relatively easy-to-manage NAT gateway using SSH and SOCKS5. | |