Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a server on an internal network that publishes web pages. I need access to these web pages from random clients on the Internet. The problem is that I don't have control of the firewall this server is behind. On the other hand, I do have access to a public server on an entirely different network. (OSes are flexible: I have access to both Windows and Linux servers on both sides.)

Here's what I'm sort of looking to do:

Is this possible?

That is:

  1. Client hits a port on my public server.
  2. That port is forwarded (tunneled?) to the internal network.
  3. Web page is served back to the client.

SSH tunneling doesn't seem quite right. Would a site-to-site VPN could do the trick? Is there a simpler option?

share|improve this question
Does your "Public Server I Control" have access through the firewall and if so, what and to where? – Hutch Sep 10 '10 at 18:02
Why doesn't SSH tunneling seem right? – Mark Wagner Sep 10 '10 at 19:05
@Hutch: no, the public server is completely independent of the rest of the systems. I only mention it because it seems like it might be helpful in solving the problem, which is ultimately to give the "Starbucks Client" HTTP access to the internal server. – ladenedge Sep 10 '10 at 19:59
@embodo: SSH tunneling seems to rely on an SSH client forwarding a port to a remote server via SSH, but in my case there is no route through the firewall to the internal server (by SSH or whatever else). Feel free to show me how it might be done, of course! – ladenedge Sep 10 '10 at 20:00
up vote 2 down vote accepted

@embodo: SSH tunneling seems to rely on an SSH client forwarding a port to a remote server via SSH, but in my case there is no route through the firewall to the internal server (by SSH or whatever else). Feel free to show me how it might be done, of course!

OK, I'll make this an answer then. I assume the internal server you control (ISIC) is allowed outbound ssh to the public server you control (PSIC). From ISIC ssh to PSIC like so:

root@ISIC # ssh -R '*:80:localhost:80' PSIC

This causes ssh to listen on port 80 of PSIC because of *:80 and then forward that to port 80 on ISIC because of localhost:80. It functions exactly like X forwarding.

share|improve this answer
Ah, I thought SSH only did the -L sort of tunneling - that was my problem! (Note that I also had to set GatewayPorts yes in my PSIC SSHD config in order get SSH to binb to non-localhost interfaces.) Wonderful info, embobo - thanks so much! – ladenedge Sep 11 '10 at 1:34

I'm not sure how you could pull this off if you can't modify the firewall. The whole point of a firewall is to block unwanted traffic, so if you can't tell the firewall "I want this traffic" I would imagine it would just do it's job.

Can the "Public Server I Control" already communicate with the "Internal Server I Control"?

share|improve this answer
The public server cannot initiate a connection with the internal server, but the internal server does have access to the Internet. – ladenedge Sep 10 '10 at 19:52

A solution such as LogMeIn provides this functionality by doing a "meet in the middle" type connection. There are also other solutions such as GoToMyPC.

LogMeIn has a free product which makes it my preferred solution:

LogMeIn also acquired the popular Hamachi solution (recommended by Steve Gibson from Security Now podcast and the Twit network), the wiki page has additional details as well as links to other solutions you could consider.

share|improve this answer
Does LogMeIn (et al.) offer HTTP access to the destination machine? My initial post wasn't very clear, but I'm really just looking to serve web resources from the internal machine - not actually log in to it. – ladenedge Sep 10 '10 at 20:16
LogMeIn runs over ports 80 & 443. It sounds like what you may be looking for is a proxy/reverse-proxy type solution. A lot depends on what is allowed by your firewall. But, as Hutch points out below, be careful that you are not violating any company polices. – Peter Sep 10 '10 at 23:41

Ask for a VPN and use it to Remote Desktop to your desktop workstation.

Then you're "inside your network" and can access what you need.

If you can't get a vpn, gotomypc or linkmein may accomplish the same thing.

share|improve this answer
Unfortunately we've already tried to "ask for" solution - we're looking for something that'll work between now and the time when the real solution is available. (And see my questions above about LinkMeIn.) – ladenedge Sep 10 '10 at 20:18

Also (and sorry to preach or state the obvious) if you don't control the firewall, are you actually supposed to be doing this?

I mention it as if you're trying to bypass restrictions your company has in place it could end very very badly for you - something to be aware of.

share|improve this answer
I appreciate the warning, heh. It'll have to suffice to say that it's not an immoral or subversive request - we're just trying to get the job done while an overworked IT department gets to doing it the right way. – ladenedge Sep 10 '10 at 20:08

Ultimately, if the goal is for "Starbucks Client" to be able to browse seamlessly to http://internal.server and for that to be the pages on your internal server, I can't think of a single way of doing it so it's pulling the pages directly from your internal server if you can't get a hole of any sort in through your firewall.

You do have options if Starbucks Client can connect to http://your.server though they're going to be bodgy at best i.e. create a VPN tunnel outbound from your LAN to your server and use redirect/forwarding of some sort with a firewall.

How often do the pages update? Could you just use rsync or something to push them out to your server if they change, or are they pulling content from a database or something?

share|improve this answer
Yes, sorry, it's not quite accurate to say that the firewall has no holes - the internal server does have unrestricted access to the Internet on all ports. And yes, clients do have access to my public server, so I'm open to dodgy options! (The web content will change anywhere from 1-10ish times per day, so I'm reluctant to go with a polling sort of solution.) – ladenedge Sep 10 '10 at 22:08

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.