SSH Tunnelling can give excellent performance and security improvements, but for the best results a little manual tweaking of firefox settings is required.

By entering "about:config" in the address bar in Firefox you can access a seperate advanced configuration screen where you can tweak the settings below.

Stopping DNS Leaks: See our detailed instructions on stopping DNS leaks in Firefox.

SSH Compression: For best results make sure that you're using compression on the SSH Tunnel - see our SSH setup guides for more info on this. It's on by default if you're using our windows or mac applications. For most text/html/css/javascript pages you can see up to 80% compression rates, improving performance massively.

More open proxy connections: When you use a proxy, Firefox limits the amount of concurrent open connections to 8. This is too small for most users as many people open multiple tabs to many sites. When more then 8 connections are made the browser seems to be "stuck" because Firefox will wait till an open connection is closed before making a new one. To avoid this problem it is highly suggested to increase the persistent connections value from 8 to 25.

network.http.max-persistent-connections-per-proxy 25

Parallel connections: An easy way to speed up Firefox is to increase the amount of parallel connections the browser makes to the server. Open up Firefox and type in "about:config" in the URL. Then search for the string "conn" You should see the following entries listed. Modify them as follows:

network.http.max-connections                        25
network.http.max-connections-per-server             25
network.http.max-persistent-connections-per-proxy   25
network.http.max-persistent-connections-per-server  25

It is _not_ recommended to use more then 25 parallel connections due to abuse of the remote server and concurrency bottlenecks on the local system. Understand that if you have a slow system then more parallel connections can actually slow the browser down considerably. Also, if you try to open too many connections to a server then that server many consider you hostile and block or blacklist you.

Pipelining Enabled: The fastest and most efficient way to implement a browser is to use pipelining. This is where a single persistent connection is used, but instead of waiting for each response before sending the next request, several requests are sent out at a time. This reduces the amount of time the client and server are waiting for requests or responses to cross the network. Pipelined requests with a single connection are faster than multiple HTTP/1.0 requests in parallel, and considerably reduce the number of packets transmitted across the network. Apache supports both HTTP/1.0 keep-alive and HTTP/1.1 persistent connections. Pipelining is implement entirely at the browser end if supported by the remote web server, using persistent connections.

To enable pipelining in Firefox browser goto the url about:config . Then search for "pipe" and set the following:

network.http.pipelining              true
network.http.pipelining.maxrequests  8
network.http.pipelining.ssl          true
network.http.proxy.pipelining        true

TLSv1 with AES256, AES128 and 3DES 168 Only: When connecting to SSL based servers (https) you only want to use the strongest ciphers available. Most web server admins can setup their servers to prefer weak ciphers over strong ciphers for any reason; sometimes they want a less CPU intensive encryption or perhaps they just configured the server wrong. Even Google's encrypted pages prefer RC4 instead of AES and this is not our idea of good security. We want to make sure that our version of Firefox only uses AES 256 bit, AES 128 bit or 3DES 168 bit ciphers.

Open up a window and type "about:config". Then in the "Filter" bar at the top search for the following. Double clicking on each line will change the value.

• tls and set the lines to true.
• ssl2 and set every line entry to false.
• ssl3 and set every line to false _except_ lines containing the strings "aes_256" and "aes_128".
• security.ssl3.rsa_des_ede3_sha and set it to true. This is the weakest cipher and may be needed for some older SSL sites.

Now your browser will _only_ accept the TLSv1 protocol in AES256 bit cipher encryption no matter what previous weaker ciphers a web server prefers. This configuration also makes your browser FIPS 120-2 compliant (year 2030 specs).