Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Every once in a while i have to connect to a server where access is highly restricted. Only inbound SSH is allowed by the DMZ firewall.

I'm looking for a good way to tunnel web access through my SSH session, so i can install updates and software via yum / apt-get.

What do you do in such a situation?

SSH has the -D <port> SOCKS proxy option. But unfortunately it is one-way only from client to server and there is no reverse option.

share|improve this question
add comment

1 Answer

up vote 4 down vote accepted

I finally managed to accomplish this with the tools available (SSH):

  1. start a SOCKS proxy on your client machine (also using SSH)
  2. connect to server and setup a reverse port forwarding (-R) to your local SOCKS proxy
  3. configure the server software to use the forwarded proxy

1. Start local socks proxy:

Connect to localhost via SSH and open SOCKS proxy on port 54321.

$ ssh -f -N -D 54321 localhost

-f runs SSH in the background.

2. connect to server and setup reverse port forwarding

Bind remote port 6666 to local port 54321. This makes your local socks proxy available to the remote site on port 6666.

$ ssh root@server -R6666:localhost:54321

3. configure the server software to use the forwarded proxy

I found that installing proxychains makes things a lot easier. Its a tool that uses an LD_PRELOAD trick to wrap TCP and DNS requests from arbitrary commands into a proxy.

This is optional - you may also configure yum or whatever to use the socks proxy, when supported. However, proxychains is really cool because it enables any software to use SOCKS proxy, even those without proxy support. (telnet for example)

Setup /etc/proxychains.conf to use the forwarded socks proxy:

[ProxyList]
# SSH reverse proxy
socks5  127.0.0.1 6666

Tunnel arbitrary tools (that use TCP) with proxychains:

$ proxychains telnet google.com 80
$ proxychains yum update
$ proxychains apt-get update
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.