Sign inSign up

easypi/stunnel

By easypi

•Updated 7 days ago

A proxy designed to add TLS encryption functionality to existing clients and servers

Image
Security
0

100K+

easypi/stunnel repository overview

⁠stunnel

Stunnel⁠ is a proxy designed to add TLS encryption functionality to existing clients and servers without any changes in the programs' code.

⁠Overview
flowchart LR
    subgraph JP["Japan"]
        M["master<br/>1.2.3.4:4911<br/>stunnel-server"]
        O["VPN<br/>1.2.3.4:1194<br/>openvpn-server"]
        M -- "forwards to<br/>1.2.3.4:1194" --> O
    end

    subgraph CN["China"]
        B["bridge<br/>5.6.7.8:1194<br/>stunnel-client"]
        C["LAN<br/>192.168/16<br/>openvpn-client"]
    end

    B -- "stunnel connection<br/>to 1.2.3.4:4911" --> M
    C -- "OpenVPN tunnel<br/>to 5.6.7.8:1194" --> B
    C -. "end-to-end path" .-> O

    classDef jp fill:#e8f4ff,stroke:#1f6feb,color:#000
    classDef cn fill:#fff4e5,stroke:#d97706,color:#000
    class M,O jp
    class B,C cn
domainip:portcountryservices
VPN1.2.3.4:1194Japanopenvpn-server
master1.2.3.4:4911Japanstunnel-server
bridge5.6.7.8:1194Chinastunnel-client
LAN192.168/16Chinaopenvpn-client

Tip

Run bridge in the same LAN as client for best performance.
⁠Server Setup (Cloud)
# master server (Japan)
docker-compose up -d master
⁠Client Setup (Cloud)
# bridge server (China)
docker-compose up -d bridge
⁠Client Setup (Local)

File: /etc/stunnel/stunnel.conf

foreground = yes
client = yes

[openvpn]
accept = 127.0.0.1:1194
connect = 1.2.3.4:4911
⁠OpenVPN Setup (Partial)
# For Cloud Setup
...
remote 5.6.7.8 1194 tcp
route 192.168.0.0 255.255.0.0 net_gateway
...

# For Local Setup
...
remote 127.0.0.1 1194 tcp
route 1.2.3.4 255.255.255.255 net_gateway
route 192.168.0.0 255.255.0.0 net_gateway
....
⁠For Gmail Forwarding
File: gmail.conf 
;
; Sample stunnel configuration file: https://www.stunnel.org/config_unix.html
;
;debug = info
;output = /var/log/stunnel.log
foreground = yes
setuid = stunnel
setgid = stunnel
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1

[gmail-pop3]
client = yes
accept = 127.0.0.1:110
connect = pop.gmail.com:995

[gmail-imap]
client = yes
accept = 127.0.0.1:143
connect = imap.gmail.com:993

[gmail-smtp]
client = yes
accept = 127.0.0.1:25
connect = smtp.gmail.com:465
File: nginx.conf 
stream {
    server {
        listen               995 ssl;
        ssl_certificate      ssl/easypi.crt;
        ssl_certificate_key  ssl/easypi.key;
        ssl_protocols        TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers          HIGH:!aNULL:!MD5;
        proxy_pass           127.0.0.1:110;
        proxy_buffer_size    16k;
    }
    server {
        listen               993 ssl;
        ssl_certificate      ssl/easypi.crt;
        ssl_certificate_key  ssl/easypi.key;
        ssl_protocols        TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers          HIGH:!aNULL:!MD5;
        proxy_pass           127.0.0.1:143;
        proxy_buffer_size    16k;
    }
    server {
        listen               465 ssl;
        ssl_certificate      ssl/easypi.crt;
        ssl_certificate_key  ssl/easypi.key;
        ssl_protocols        TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers          HIGH:!aNULL:!MD5;
        proxy_pass           127.0.0.1:25;
        proxy_buffer_size    16k;
    }
}

Important

You need to adjust the listening address for docker deployment

Tag summary

Content type

Image

Digest

sha256:93b8d76f1…

Size

5.4 MB

Last updated

7 days ago

docker pull easypi/stunnel