2

Thanks in advance for any help/advice provided. I have the following setup

  • I have an Ubuntu server (ubuntu_server) which provides SSH access (using keys only, no username/password) to internet connected users (ubuntu_server is on LAN_1)
  • I can connect to ubuntu_server from Windows clients (windows_client) using PuTTY + Pageant (windows_client is on LAN_2)
  • Using instructions provided here (http://www.devdaily.com/unix/edu/putty-ssh-tunnel-firefox-socks-proxy/1-putty-ssh-tunnel-introduction.shtml) I can use Firefox/Chrome (not tried IE yet) and route my web-browsing on windows_client through ubuntu_server. If I understand correctly its a safe, encrypted way to access internet (if at a public wifi for e.g.).

As a side effect of this, I realized that I can access HTTP/HTTPS/FTP services on ubuntu_server as though they were on the same LAN (i.e. windows_client on LAN_2 can access resources of LAN_1, at least those on ubuntu_server). So I am trying to accomplish the following (not even sure if its doable or feasible)

  • Use "SSH + PuTTY + Firefox/Chrome socks proxy" to provide Intranet access to users who connect to ubuntu_server over Internet but take it further and not only provide access to services installed on ubuntu_server but also from ubuntu_server_2, windows_server_1 - which are on same LAN as ubuntu_server (i.e. LAN_1).
  • So how do I configure it, so that when user SSH' in to ubuntu_server and in Firefox (over proxy of course) enters "https://ubuntu_server_2" they are served by HTTPS service on ubuntu_server_2 (and similarly for windows_server_1)

I did a few searches on Google and ServerFault, and found nothing, but I don't know if I am using the right keywords ("intranet over ssh") to find an answer.

4 Answers 4

3

What you are discussing is setting up a Virtual Private Network (VPN). And yes, you can use SSH to setup a primitive VPN, but you might look into the other options, too.

Other links from google search for SSH VPN.

NB: updated the "the other options" link because my first try was way, way out of date, the new one is just way out of date.

1
  • Thanks. I think this has sufficient information for me to consider an answer. I will mark as answer if I get none better.
    – ossandcad
    Jan 16, 2010 at 0:37
2

You can do what you're describing, but you'll need to make a change in your proxy settings. Your proxy will need to be setup to perform DNS lookups on the remote side (send them through the proxy). Also, ubuntu_server_1 will need to be able to resolve ubuntu_server_2 and windows_server_1 (probably already setup).

As long as you can make the proxy perform your DNS lookups for you, it should work just fine. Apparently FireFox will let you do this by opening the about:config page and changing network.proxy.socks_remote_dns to true. (I haven't tested this, I just looked it up.)

1
  • "Proxy will need to be setup to perform DNS lookups on remote side" - does that mean I need a proxy server, like Squid, on ubuntu_server? Also how do i have ubuntu_server_1 resolve ubuntu_server_2, windows_server_1 - bind9? or SMB? Any links would be most helpful.
    – ossandcad
    Jan 16, 2010 at 0:35
2

You probably dont want to use SSH for a VPN. While it works, one little hiccup in the connection can cause a TCP hiccup. You'd be far better off using a UDP style VPN like OpenVPN or Hamachi.

3
  • TCP hiccup? I apologize, I don't know what that means or signifies. Could you describe what problem it could cause?
    – ossandcad
    Jan 16, 2010 at 0:33
  • If the SSH session has a TCP stall, the client is effectively disconnected while the RTO timer expires... which in the worst case can take a couple of hours. Jan 16, 2010 at 6:29
  • 1
1

It does sound like your main issue may just be DNS.

Since you are already having ubuntu_server do your lookups for you it should already be able to access the other items in lan_2.

However, on your remote computer when you try to go to https://ubuntu_server_2/ it is trying to look that up in DNS locally before it contacts the proxy server.

A quick way to test this would be instead of going to https://ubuntu_server_2/ try going to the ip address of ubuntu_server_2 on lan_1 (ex: https://192.168.1.5). That will take the DNS portion out of play as you are telling firefox exactly what address you want to go to.

1
  • You were right. It does seem to be a DNS issue. I can access other servers inside based on IP address. Wonder if it is just as easy to do non-browser proxying?
    – ossandcad
    Jan 19, 2010 at 16:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .