chisel

Features

Install

docker run --rm -it jpillora/chisel --help

$ go get -v github.com/jpillora/chisel

Demo

$ chisel server --port $PORT --proxy http://example.com
# listens on $PORT, proxy web requests to http://example.com

$ chisel client https://chisel-demo.herokuapp.com 3000
# connects to chisel server at https://chisel-demo.herokuapp.com,
# tunnels your localhost:3000 to the server's localhost:3000

Usage

$ chisel --help
 Usage: chisel [command] [--help]
 Version: 0.0.0-src (go1.14.3)
 Commands:
 server - runs chisel in server mode
 client - runs chisel in client mode
 Read more:
 https://github.com/jpillora/chisel

$ chisel server --help
 Usage: chisel server [options]
 Options:
 --host, Defines the HTTP listening host – the network interface
 (defaults the environment variable HOST and falls back to 0.0.0.0).
 --port, -p, Defines the HTTP listening port (defaults to the environment
 variable PORT and fallsback to port 8080).
 --key, An optional string to seed the generation of a ECDSA public
 and private key pair. All communications will be secured using this
 key pair. Share the subsequent fingerprint with clients to enable detection
 of man-in-the-middle attacks (defaults to the CHISEL_KEY environment
 variable, otherwise a new key is generate each run).
 --authfile, An optional path to a users.json file. This file should
 be an object with users defined like:
 {
 "<user:pass>": ["<addr-regex>","<addr-regex>"]
 }
 when <user> connects, their <pass> will be verified and then
 each of the remote addresses will be compared against the list
 of address regular expressions for a match. Addresses will
 always come in the form "<remote-host>:<remote-port>" for normal remotes
 and "R:<local-interface>:<local-port>" for reverse port forwarding
 remotes. This file will be automatically reloaded on change.
 --auth, An optional string representing a single user with full
 access, in the form of <user:pass>. It is equivalent to creating an
 authfile with {"<user:pass>": [""]}. If unset, it will use the
 environment variable AUTH.
 --keepalive, An optional keepalive interval. Since the underlying
 transport is HTTP, in many instances we'll be traversing through
 proxies, often these proxies will close idle connections. You must
 specify a time with a unit, for example '5s' or '2m'. Defaults
 to '25s' (set to 0s to disable).
 --proxy, Specifies another HTTP server to proxy requests to when
 chisel receives a normal HTTP request. Useful for hiding chisel in
 plain sight.
 --socks5, Allow clients to access the internal SOCKS5 proxy. See
 chisel client --help for more information.
 --reverse, Allow clients to specify reverse port forwarding remotes
 in addition to normal remotes.
 --pid Generate pid file in current working directory
 -v, Enable verbose logging
 --help, This help text
 Signals:
 The chisel process is listening for:
 a SIGUSR2 to print process stats, and
 a SIGHUP to short-circuit the client reconnect timer
 Version:
 0.0.0-src (go1.14.3)
 Read more:
 https://github.com/jpillora/chisel

$ chisel client --help
 Usage: chisel client [options] <server> <remote> [remote] [remote] ...
 <server> is the URL to the chisel server.
 <remote>s are remote connections tunneled through the server, each of
 which come in the form:
 <local-host>:<local-port>:<remote-host>:<remote-port>
 ■しかく local-host defaults to 0.0.0.0 (all interfaces).
 ■しかく local-port defaults to remote-port.
 ■しかく remote-port is required*.
 ■しかく remote-host defaults to 0.0.0.0 (server localhost).
 which shares <remote-host>:<remote-port> from the server to the client
 as <local-host>:<local-port>, or:
 R:<local-interface>:<local-port>:<remote-host>:<remote-port>
 which does reverse port forwarding, sharing <remote-host>:<remote-port>
 from the client to the server's <local-interface>:<local-port>.
 example remotes
 3000
 example.com:3000
 3000:google.com:80
 192.168.0.5:3000:google.com:80
 socks
 5000:socks
 R:2222:localhost:22
 R:socks
 R:5000:socks
 stdio:example.com:22
 When the chisel server has --socks5 enabled, remotes can
 specify "socks" in place of remote-host and remote-port.
 The default local host and port for a "socks" remote is
 127.0.0.1:1080. Connections to this remote will terminate
 at the server's internal SOCKS5 proxy.
 When the chisel server has --reverse enabled, remotes can
 be prefixed with R to denote that they are reversed. That
 is, the server will listen and accept connections, and they
 will be proxied through the client which specified the remote.
 Reverse remotes specifying "R:socks" will listen on the server's
 default socks port (1080) and terminate the connection at the
 client's internal SOCKS5 proxy.
 When stdio is used as local-host, the tunnel will connect standard
 input/output of this program with the remote. This is useful when 
 combined with ssh ProxyCommand. You can use
 ssh -o ProxyCommand='chisel client chiselserver stdio:%h:%p' \
 user@example.com
 to connect to an SSH server through the tunnel.
 Options:
 --fingerprint, A *strongly recommended* fingerprint string
 to perform host-key validation against the server's public key.
 You may provide just a prefix of the key or the entire string.
 Fingerprint mismatches will close the connection.
 --auth, An optional username and password (client authentication)
 in the form: "<user>:<pass>". These credentials are compared to
 the credentials inside the server's --authfile. defaults to the
 AUTH environment variable.
 --keepalive, An optional keepalive interval. Since the underlying
 transport is HTTP, in many instances we'll be traversing through
 proxies, often these proxies will close idle connections. You must
 specify a time with a unit, for example '5s' or '2m'. Defaults
 to '25s' (set to 0s to disable).
 --max-retry-count, Maximum number of times to retry before exiting.
 Defaults to unlimited.
 --max-retry-interval, Maximum wait time before retrying after a
 disconnection. Defaults to 5 minutes.
 --proxy, An optional HTTP CONNECT or SOCKS5 proxy which will be
 used to reach the chisel server. Authentication can be specified
 inside the URL.
 For example, http://admin:password@my-server.com:8081
 or: socks://admin:password@my-server.com:1080
 --header, Set a custom header in the form "HeaderName: HeaderContent".
 Can be used multiple times. (e.g --header "Foo: Bar" --header "Hello: World")
 --hostname, Optionally set the 'Host' header (defaults to the host
 found in the server url).
 --pid Generate pid file in current working directory
 -v, Enable verbose logging
 --help, This help text
 Signals:
 The chisel process is listening for:
 a SIGUSR2 to print process stats, and
 a SIGHUP to short-circuit the client reconnect timer
 Version:
 0.0.0-src (go1.14.3)
 Read more:
 https://github.com/jpillora/chisel

Security

Authentication

SOCKS5 Guide

docker run \
 --name chisel -p 9312:9312 \
 -d --restart always \
 jpillora/chisel server -p 9312 --socks5 --key supersecret

chisel client --fingerprint ab:12:34 <server-address>:9312 socks

<client-address>:1080

Caveats

Contributing

Changelog