kenzuya/unshackle
1
0
Fork 2
mirror of https://github.com/unshackle-dl/unshackle.git synced 2026-11-14 13:05:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

Deployed 8454f40 with MkDocs version: 1.6.1

Browse Source
This commit is contained in:
2026-10-27 16:16:52 +00:00
parent c5460e20cb
commit 94045c2b99
2 changed files with 11 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
guide/proxies-and-vpn/index.html
+10 -8
View File
@@ -3055,14 +3055,16 @@ do not configure ports: the server picks a free one, and your
machine opens none, because the client opens the connection to the server. A NAT router, a
firewall, or a Cloudflare tunnel in front of the server does not stop it.</p>
<p>The service traffic stays encrypted from the server to the service, so the client relays only
encrypted bytes. The client refuses to connect to <code>localhost</code>, and to a host name or IP address
that resolves only to a loopback, private or link-local address, so the server cannot reach
your local network.
A VPN or proxy app in TUN mode with fake-IP DNS answers a host name with an address from
<code>198.18.0.0/15</code> or <code>2001:2::/48</code> and maps it back to the real host. The client accepts that
address for a host name, but not as an IP address from the server. An app set to a different
fake-IP range does not work with <code>--local-proxy</code>. With fake-IP DNS, the client cannot see the
real address of a host name, so it cannot stop a host name that points into your local network.</p>
encrypted bytes. The client refuses to connect to <code>localhost</code>, and to a host name that resolves
only to an address on your machine or local network: loopback, private, link-local, CGNAT
(<code>100.64.0.0/10</code>) or multicast. An IP address that the server sends must also be public, and
the client closes a connection that reaches one of its own addresses. Other devices on your
network that have a public IPv6 address, and your router's public address, are not blocked.</p>
<p>Some VPN and proxy apps answer a host name with a synthetic address, for example fake-IP DNS in
TUN mode (<code>198.18.0.0/15</code>), and map it back to the real host. The client accepts any such
address for a host name, so <code>--local-proxy</code> works with these apps. The client cannot see the
real address behind a synthetic one, so it cannot stop a host name that points into your local
network.</p>
<div class="admonition note">
<p class="admonition-title">Each request crosses the tunnel twice</p>
<p>A request from the server goes to your machine and then to the service, so it takes
search/search_index.json
+1 -1
View File
File diff suppressed because one or more lines are too long