Published ports are not working with certain applications

[engageub]

Hi,

When the Mysterium application is enabled with ports published via the hev-socks5 tunnel, the application is not accessible. However, when tun2socks is used instead, the application is accessible through the published ports.

While the Firefox browser works correctly with ports published through the hev-socks5 tunnel, the Mysterium application does not. The Mysterium application can be accessed internally after logging into the hev-socks5 container, but it is not accessible externally from outside the container.

Steps to reproduce:

1. Download the Internet Income script.
2. Enable Mysterium and set USE_PROXIES to true in the properties.conf file. Add any proxy entry to the proxies.txt file.
3. If USE_SOCKS5_DNS is not enabled in properties.conf, tun2socks is used by default.
4. Set USE_SOCKS5_DNS to true to enable the hev-socks5-tunnel.
5. Run a curl command using the published ports, for example:
   curl http://127.0.0.1:2000

Thank you.

[heiher]

The hev-socks5-tunnel does not support publishing ports on the server side from the client.

[engageub]

But it is working with docker firefox browser and not this particular application. Tun2socks works will all applications when ports are published. Same configuration is being used.

[heiher]

Add a exclude route for docker network addresses? (IPV4_EXCLUDED_ROUTES)

[engageub]

Hi,
Could you please clarify why traffic needs to be excluded in this case?

My requirement is simply to set up a port forward from the container to the host. When I run a curl request from within the hev-socks5 tunnel, it works as expected. However, accessing the same service from outside the container via the mapped port does not work.

Thank you

[heiher]

The server's outgoing traffic needs to be routed to the host via docker veth iface instead of tun iface.

[engageub]

Hi,

To better explain the issue, please run the commands below. Ashburn proxies were used during testing.

sudo docker run --name hevsocks --restart=always -e LOG_LEVEL=debug \
-e SOCKS5_USERNAME=user -e SOCKS5_PASSWORD=password \
-e SOCKS5_ADDR=ip_address -e SOCKS5_PORT=port_number \
-p 4449:4449 -p 5800:5800 \
-v '/dev/net/tun:/dev/net/tun' --cap-add=NET_ADMIN \
-d ghcr.io/heiher/hev-socks5-tunnel:latest

sudo docker run -d --name myst --network="container:hevsocks" \
mysteriumnetwork/myst:latest service --agreed-terms-and-conditions

When testing connectivity from the host:

curl http://127.0.0.1:4449

This request does not work, although the port is accessible from inside the container.

Next, run:

docker run -d --name firefox --network="container:hevsocks" jlesage/firefox

Then test:

curl http://127.0.0.1:5800

This request works as expected.

After testing, remove all three containers using:

docker rm -f firefox myst hevsocks

At this point, it is unclear why the Firefox port (5800) is accessible from the host, while the Mysterium service port (4449) is not, despite both containers sharing the same network namespace.

Additionally, I would like to highlight that Proxiware proxies do not work with UDP when the HevSocks tunnel is used. These proxies also do not function with tun2socks. There is an ongoing related issue here:
xjasonlyu/tun2socks#262

However, the same proxies work correctly when using tun2proxy.

If needed, I can share a proxy for testing purposes, or you may obtain one directly from the Proxiware website https://proxiware.com/.

Please let me know if you need any further details.