Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

From my PC, i use:

ssh -fND localhost:6000 USERNAME@IPADDRESS -p PORTNUMBER

and i set this true in Firefox:
network.proxy.socks_remote_dns

and i set the socks proxy to 127.0.0.1:6000 in Firefox, then i can browse the web, with the public ip of the router/server behind the "IPADDRESS". That's ok.
Behind the "IPADDRESS", theres an OpenWrt router with private ip 192.168.1.1, and "bad" people could be using that OpenWrt router [e.g.: only just a few clients on it, like: 192.168.1.6; 192.168.1.100, etc..].

Here comes the question:
Can those "bad people" "sniff" the traffic between my PC's Firefox, and the OpenWrt routers WebGUI? [to set a few things on it, i need it's webgui, and it's using normal http].
True or false?: So if i ssh tunnel to a router, it's like i'm a client among the other clients: 192.168.1.100; 192.168.1.6, etc.? So the traffic could be sniffed?
I'm asking it, because if it could be sniffed, i need to install a lighttpd+ssl on that openwrt router, and theres not much space on it, to do that. :. Do i need https on the OpenWrt router?
Thank you!

share|improve this question
add comment

3 Answers

up vote 0 down vote accepted

If I understand your question correctly, yes, Malicious users could sniff your traffic at the router. That is assuming that the connection is as follows.

LOGICAL ORDERING 1) your desktop / laptop that you are opening the localhost:6000 tunnel on 2) the device at IPADDRESS you are opening the tunnel to 3) the openWRT router 4) the internet

IF I am remembering correctly, openWRT should natively (default install) support https connections to the web interface and certainly supports ssh connections to it. This would prevent the 'sniffing' of your traffic. However, if the device itself is compromised it won't matter what you do until you get the router cleaned up.

share|improve this answer
    
hey! i found a link! forum.openwrt.org/viewtopic.php?pid=80583#p80583 Thank you! –  LanceBaynes Jan 19 '11 at 10:37
add comment

What kind of access do the other people have ?

generally they cannot see the contents (the traffic is encrypted)

Moreover, It's like browsing a web server in your localhost. Let's say that you are the A, ssh is B and web server is C. B,C traffic is in localhost.

A --> ( B -> C )

Of course if they have super priviledges they can do anything. But if they are just connected client, you won't have problem.

share|improve this answer
    
No, the clients are only clients [don't have access to the OpenWRT router]. [but they could have root priviledges on their PC.] –  LanceBaynes Jan 19 '11 at 10:34
    
Even if they are gods on their PCs ... they are simple mortals in your router ... so don't worry. you are safe (except for the case that they find the keyword and decrypt the traffic ... but that's something else) –  Nikolaidis Fotis Jan 19 '11 at 22:25
add comment

If IPADDRESS is assigned to the OpenWrt router, then nothing can be intercepted unless someone has access to your PC or the OpenWrt router.

If IPADDRESS is assigned to a different device than the OpenWrt router, then your communication could be intercepted by anyone with access to the link(s) between the IPADDRESS device and the OpenWrt router.

In either case, if the "bad guys" have access to the OpenWrt router itself, there's nothing you can do since no matter what, the data has to get decrypted on the OpenWrt router for it to be of any use.

share|improve this answer
    
the OpenWrt router is behind the IPADDRESS. So if i ssh tunnel to it, i could safely browse it's webgui over http. [the only problem would be if a client spoofs his MAC address to be 192.168.1.1? ok.]. Thank you! –  LanceBaynes Jan 19 '11 at 10:33
    
I'm still not completely clear what your setup looks like. If by saying the "router is behind the IP" you mean the router is configured with that IP on one of its interfaces, then my first and third paragraph apply and you probably don't have to worry about a user impersonating the router. If by saying the "router is behind the IP" you mean the IP is on a different physical device then my second paragraph applies and users could potentially intercept your traffic or impersonate the router. If it's the second case, enabling HTTPS would work. –  eater Jan 19 '11 at 13:44
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.