From my PC, i use:
ssh -fND localhost:6000 USERNAME@IPADDRESS -p PORTNUMBER
and i set this true in Firefox:
and i set the socks proxy to 127.0.0.1:6000 in Firefox, then i can browse the web, with the public ip of the router/server behind the "IPADDRESS". That's ok.
Behind the "IPADDRESS", theres an OpenWrt router with private ip 192.168.1.1, and "bad" people could be using that OpenWrt router [e.g.: only just a few clients on it, like: 192.168.1.6; 192.168.1.100, etc..].
Here comes the question:
Can those "bad people" "sniff" the traffic between my PC's Firefox, and the OpenWrt routers WebGUI? [to set a few things on it, i need it's webgui, and it's using normal http].
True or false?: So if i ssh tunnel to a router, it's like i'm a client among the other clients: 192.168.1.100; 192.168.1.6, etc.? So the traffic could be sniffed?
I'm asking it, because if it could be sniffed, i need to install a lighttpd+ssl on that openwrt router, and theres not much space on it, to do that. :. Do i need https on the OpenWrt router?
From my PC, i use:
If I understand your question correctly, yes, Malicious users could sniff your traffic at the router. That is assuming that the connection is as follows.
LOGICAL ORDERING 1) your desktop / laptop that you are opening the localhost:6000 tunnel on 2) the device at IPADDRESS you are opening the tunnel to 3) the openWRT router 4) the internet
IF I am remembering correctly, openWRT should natively (default install) support https connections to the web interface and certainly supports ssh connections to it. This would prevent the 'sniffing' of your traffic. However, if the device itself is compromised it won't matter what you do until you get the router cleaned up.
What kind of access do the other people have ?
generally they cannot see the contents (the traffic is encrypted)
Moreover, It's like browsing a web server in your localhost. Let's say that you are the A, ssh is B and web server is C. B,C traffic is in localhost.
A --> ( B -> C )
Of course if they have super priviledges they can do anything. But if they are just connected client, you won't have problem.
If IPADDRESS is assigned to the OpenWrt router, then nothing can be intercepted unless someone has access to your PC or the OpenWrt router.
If IPADDRESS is assigned to a different device than the OpenWrt router, then your communication could be intercepted by anyone with access to the link(s) between the IPADDRESS device and the OpenWrt router.
In either case, if the "bad guys" have access to the OpenWrt router itself, there's nothing you can do since no matter what, the data has to get decrypted on the OpenWrt router for it to be of any use.