本頁面暫無您所用語言的版本，您正在閱讀英文原文。
Glossary
SSH tunnel
An SSH tunnel is an encrypted connection to a server you control that carries your browsing out through its address.
What the browser is handed
The browser knows nothing about SSH and never needs to. A tunnel runs beside the profile and opens a real SOCKS5 entrance on loopback.
For the engine that is an ordinary local address, so no launch path becomes special and nothing is downgraded behind your back.
A broken tunnel cannot leak
The local entrance belongs to the tunnel itself and dies with it. Every request from that window is then turned away rather than taking another road.
The port goes with the tunnel
Nothing else is listening there, so there is no quiet second path for the browser to find.
A launch refuses what it cannot express
A profile whose exit cannot be handed to the engine is not opened at all, rather than opened direct.
A tunnel does not pretend to be alive
One that cannot take its port stops instead of standing up and carrying nothing.
A dead window is the safe outcome
Where the password goes
Never into the command line, which every process under your account can read. The tunnel is asked for it through a nameless channel in an owner only folder, wiped the moment it is read.
On Windows there is no safe way to hand one over, so an entry there takes a key file and the program says so instead of failing quietly.
Often confused with
A VPN
A VPN moves the whole machine. A tunnel here belongs to one profile, and the profile beside it keeps its own exit.
A bought SOCKS5 address
What the browser sees is the same shape. The difference is that the machine at the far end is yours and the address is not shared with strangers.
Forwarding a single port
That reaches one service on one port. Browsing needs dynamic forwarding, and without it the tunnel is no use here.
Tor
Tor routes through volunteer relays and publishes the addresses of its last hops. Here there is one hop and it is yours.
What this does not do
- It does not give you a server. It uses a machine you already have access to, and its address is exactly as good as that machine's network.
- It does not change what the browser reports. Only the exit moves, along with the clock and the language list that follow its country.
- It does not carry your key to another computer. The path is read on this machine, so on a second one you point at the key again.
- It does not take a password on Windows. A key file is the only road there.
Check it
Each claim above is one place in the code and one stand.
- How the tunnel is raised and which arguments it is given
- apps/desktop/src/lib/sshTunnel.js
- No password in the arguments, and a drop retried three times
- apps/desktop/test/выход-по-ssh.js
- The answering helper and the channel are written owner only
- apps/desktop/test/secrets-on-disk.js
- The gate that stops a profile going out past its exit
- apps/desktop/src/main/main.js
Questions
- Does my own SSH configuration apply?
- No. The tunnel keeps its own file of known servers inside the program data and leaves your personal setup alone, because a jump host written there could send a profile somewhere you never chose.
- Will my personal known hosts file be written to?
- No. That file is how you sign in to work, and it is not ours to edit.
- What happens when my server reboots?
- Pages stop loading while it is gone. The tunnel is tried again on the same port, and once the server answers a fresh launch raises a fresh one.
- Does pressing the check button leave a connection open?
- No. A check raises a real tunnel, measures through it, and takes it down as soon as the answer arrives.
Make an exit of a server you already pay for
The free plan gives two profiles, with no time limit and no card.