0

From my PC, i use:

ssh -fND localhost:6000 USERNAME@IPADDRESS -p PORTNUMBER

and i set this true in Firefox:
network.proxy.socks_remote_dns

and i set the socks proxy to 127.0.0.1:6000 in Firefox, then i can browse the web, with the public ip of the router/server behind the "IPADDRESS". That's ok.
Behind the "IPADDRESS", theres an OpenWrt router with private ip 192.168.1.1, and "bad" people could be using that OpenWrt router [e.g.: only just a few clients on it, like: 192.168.1.6; 192.168.1.100, etc..].

Here comes the question:
Can those "bad people" "sniff" the traffic between my PC's Firefox, and the OpenWrt routers WebGUI? [to set a few things on it, i need it's webgui, and it's using normal http].
True or false?: So if i ssh tunnel to a router, it's like i'm a client among the other clients: 192.168.1.100; 192.168.1.6, etc.? So the traffic could be sniffed?
I'm asking it, because if it could be sniffed, i need to install a lighttpd+ssl on that openwrt router, and theres not much space on it, to do that. :. Do i need https on the OpenWrt router?
Thank you!

3 Answers 3

0

If I understand your question correctly, yes, Malicious users could sniff your traffic at the router. That is assuming that the connection is as follows.

LOGICAL ORDERING 1) your desktop / laptop that you are opening the localhost:6000 tunnel on 2) the device at IPADDRESS you are opening the tunnel to 3) the openWRT router 4) the internet

IF I am remembering correctly, openWRT should natively (default install) support https connections to the web interface and certainly supports ssh connections to it. This would prevent the 'sniffing' of your traffic. However, if the device itself is compromised it won't matter what you do until you get the router cleaned up.

1
0

What kind of access do the other people have ?

generally they cannot see the contents (the traffic is encrypted)

Moreover, It's like browsing a web server in your localhost. Let's say that you are the A, ssh is B and web server is C. B,C traffic is in localhost.

A --> ( B -> C )

Of course if they have super priviledges they can do anything. But if they are just connected client, you won't have problem.

2
  • No, the clients are only clients [don't have access to the OpenWRT router]. [but they could have root priviledges on their PC.] Jan 19, 2011 at 10:34
  • Even if they are gods on their PCs ... they are simple mortals in your router ... so don't worry. you are safe (except for the case that they find the keyword and decrypt the traffic ... but that's something else) Jan 19, 2011 at 22:25
0

If IPADDRESS is assigned to the OpenWrt router, then nothing can be intercepted unless someone has access to your PC or the OpenWrt router.

If IPADDRESS is assigned to a different device than the OpenWrt router, then your communication could be intercepted by anyone with access to the link(s) between the IPADDRESS device and the OpenWrt router.

In either case, if the "bad guys" have access to the OpenWrt router itself, there's nothing you can do since no matter what, the data has to get decrypted on the OpenWrt router for it to be of any use.

2
  • the OpenWrt router is behind the IPADDRESS. So if i ssh tunnel to it, i could safely browse it's webgui over http. [the only problem would be if a client spoofs his MAC address to be 192.168.1.1? ok.]. Thank you! Jan 19, 2011 at 10:33
  • I'm still not completely clear what your setup looks like. If by saying the "router is behind the IP" you mean the router is configured with that IP on one of its interfaces, then my first and third paragraph apply and you probably don't have to worry about a user impersonating the router. If by saying the "router is behind the IP" you mean the IP is on a different physical device then my second paragraph applies and users could potentially intercept your traffic or impersonate the router. If it's the second case, enabling HTTPS would work.
    – eater
    Jan 19, 2011 at 13:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .