I finally managed to accomplish this with only SSH:
- start a SOCKS proxy on your client machine (also using SSH)
- connect to server and setup a reverse port forwarding (-R) to your local SOCKS proxy
- configure the server software to use the forwarded proxy
1. Start local socks proxy:
Connect to localhost via SSH and open SOCKS proxy on port 54321.
$ ssh -f -N -D 54321 localhost
-f runs SSH in the background.
2. connect to server and setup reverse port forwarding
Bind remote port 6666 to local port 54321. This makes your local socks proxy available to the remote site on port 6666.
$ ssh root@server -R6666:localhost:54321
3. configure the server software to use the forwarded proxy
I found that installing
proxychains makes things a lot easier. Its a tool that uses an
LD_PRELOAD trick to wrap TCP and DNS requests from arbitrary commands into a proxy.
This is optional - you may also configure yum or whatever to use the socks proxy, when supported. However,
proxychains is really cool because it enables any software to use SOCKS proxy, even those without proxy support. (
telnet for example)
/etc/proxychains.conf to use the forwarded socks proxy:
# SSH reverse proxy
socks5 127.0.0.1 6666
Tunnel arbitrary tools (that use TCP) with
$ proxychains telnet google.com 80
$ proxychains yum update
$ proxychains apt-get update