Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Once in a while i have to connect to a server where access is highly restricted.
Only inbound SSH is allowed by the DMZ firewall.
Outbound HTTP connections are blocked.

I'm looking for a good way to tunnel web access through my SSH session, so i can install updates and software via yum / apt-get.

What do you do in such a situation?

SSH has the -D <port> SOCKS proxy option. But unfortunately it's ony one-way from client to server and there is no reverse option.

share|improve this question
up vote 12 down vote accepted

I finally managed to accomplish this with only SSH:

  1. start a local SOCKS proxy on your client machine (using ssh -D)
  2. connect to server and setup a reverse port forwarding (ssh -R) to your local SOCKS proxy
  3. configure the server software to use the forwarded proxy

1. Start local socks proxy:

Connect to localhost via SSH and open SOCKS proxy on port 54321.

$ ssh -f -N -D 54321 localhost

-f runs SSH in the background.

2. connect to server and setup reverse port forwarding

Bind remote port 6666 to local port 54321. This makes your local socks proxy available to the remote site on port 6666.

$ ssh root@server -R6666:localhost:54321

3. configure the server software to use the forwarded proxy

I found that installing proxychains makes things a lot easier. Its a tool that uses an LD_PRELOAD trick to wrap TCP and DNS requests from arbitrary commands into a proxy.

This is optional - you may also configure yum or whatever to use the socks proxy, when supported. However, proxychains is really cool because it enables any software to use SOCKS proxy, even those without proxy support. (telnet for example)

Setup /etc/proxychains.conf to use the forwarded socks proxy:

# SSH reverse proxy
socks5 6666

Tunnel arbitrary tools (that use TCP) with proxychains:

$ proxychains telnet 80
$ proxychains yum update
$ proxychains apt-get update
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.