socksns

此工具将在隔离的网络命名空间中运行程序，允许程序仅连接到单个 TCP 地址，如 SOCKS 代理。这有助于防止可能泄露非代理请求的意外代理绕过问题。

安装

运行 socksns 需要 unprivileged user namespaces 的支持。这默认在主线内核和大多数发行版中已启用，但您可能想确保 /proc/sys/kernel/unprivileged_userns_clone 不是 0。

# install the latest release from crates.io
cargo install socksns

# install the latest development version
git clone https://github.com/stevenengler/socksns.git
cargo install --path socksns

示例

如果您有一个运行在端口 9050 的 SOCKS 代理（例如 Tor）

socksns torsocks curl google.com
socksns curl --proxy socks5h://127.0.0.1:9050 google.com

您也可以代理来自其他网络命名空间的连接

podman run --rm -it --name socksns-demo --network none fedora:40

PID="$(podman ps -l --filter "name=socksns-demo" --format "{{.Pid}}")"
socksns --netns /proc/"$PID"/ns/net sleep infinity

在 podman 容器中运行的任何内容都将能够访问 socksns 打开的所有端口。当您想要一个只能通过 SOCKS 代理访问互联网的隔离容器时，这非常有用。

用法

This tool will run a program in an isolated network namespace, allowing
the program to connect only to a single TCP address such as a SOCKS proxy

Usage: socksns [OPTIONS] <COMMAND>...

Arguments:
  <COMMAND>...
          The command to run within the namespace

Options:
      --debug
          Show debug-level log messages

      --proxy <LOCAL_PORT:EXT_ADDRESS:EXT_PORT>
          Configure how connections are proxied.

          Proxy TCP connections made to '127.0.0.1:LOCAL_PORT' within the
          new namespace to 'EXT_ADDRESS:EXT_PORT' outside of the
          namespace.

          [default: 9050:localhost:9050]

      --netns <PATH>
          Use an existing network namespace instead of creating a new
          isolated one.

          The program will be able to use all network interfaces within
          this namespace, possibly using them to access the Internet
          directly. If you wish to isolate the program's network traffic,
          you must configure the network namespace correctly. This option
          will also automatically enter the network namespace's user
          namespace. Elevated privileges may be required depending on how
          the user namespaces are structured.

  -h, --help
          Print help (see a summary with '-h')

  -V, --version
          Print version