Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

The setup:

  • A windows workstation with Full admin rights.
  • A very restrictive http proxy, which, however, accepts connection towards port 80 and port 443 only.
  • A linux box on the internet I have complete control of.

Currently, what I do, which is working:

  • The linux box run sshd, listening on port 443.
  • In putty, I can connect to the linux box simply by configuring in the proxy configuration panel the proxy as an HTTP proxy.

What I would like to achieve:

Run a browser, on my Windows box and, by using some kind of ssh tunnel, browse the web without any limitations.

I believe this is called proxy bouncing, or something like this. But I must admit, that I am a bit lost.

From what I understood, I would have to configure a tunnel into putty, listening on port 8889 on the windows box for example. I would then be able to configure the browser to use a proxy located at localhost:8889

The moment where things are becoming blurry is now.

On the linux box, I would have to configure a ProxyCommand in the SSH config file or something like that to do Port Forwarding ? In addition, would I have to run a proxy like squid on the linux box ? Some kind of tutorial I found describe a setup with Apache:

Or am I completly in the wrong direction and do I have to run ProxyTunnel both on the windows and linux box ?

Thanks for your help.

Edit: Actually, the question is more: What do I have to do on the linux side of the tunnel

share|improve this question
add comment

6 Answers

up vote 2 down vote accepted

There are two parts to getting this to work, so I'll address them seperately.

Connecting to your Server:

As you've mentioned that all you can talk to is a proxy on 443 and 80, you'll need to tunnel your SSH connection out through the proxy. You do that by telling Putty to use the proxy server to connect. Under the 'proxy' menu. Select HTTP and then enter the details for the corporate proxy.

From your post, it seems like you've got the connection working fine.

Configure Putty to Create a SOCKS proxy on the local machine

Both putty and OpenSSH support opening a SOCKS proxy. For OpenSSH you'd use:

ssh -D <port>

And then point your browser at that port. In putty you create a 'dynamic' port forward. You'll find it under the Tunnels menu. Enter your desired listening port and then enter anything you like as a destination (it gets ignored for dynamic forwards). You can then point your browsers proxy settings at that localhost:<port> and it should work.

For more information, the relevant part of the putty documentation is at http://tartarus.org/~simon/putty-snapshots/htmldoc/Chapter3.html#using-port-forwarding.


As others have posted you may not want to circumvent the corporate filtering though as it's not something you may want to explain :).

share|improve this answer
    
The name of the menu in putty is Tunnels actually. –  David Jul 30 '09 at 14:38
    
Thanks, updated –  Frenchie Jul 30 '09 at 14:49
    
I understand first part (which is already working indeed) and second part. But: I don't get how it will work on the linux side. I mean, what the ssh server will do with the packets directed to a proxy ? Don't I have to configure a proxy on the linux box ? At the end, how will the http request be forwarded to the web site I am trying to contact? –  David Jul 30 '09 at 15:20
    
As long as you haven't disabled it, the OpenSSH server will handle that for you, no additional config should be needed. –  Frenchie Jul 30 '09 at 15:26
    
Thanks, it workss actually, but I don't get how, and that is what annoy me. –  David Jul 30 '09 at 15:29
show 1 more comment

I think set up a local ssh tunnel should work well for you:

  1. set up the http proxy on the linux box at port xxxx
  2. connect the linux box with a ssh local tunnel, the ssh client command would like:

    ssh -L 8899:127.0.0.1:xxxx user@remote -p 443

putty may similar but use dialog.

share|improve this answer
add comment

With ssh you can set up "dynamic port forwarding". See http://www.panix.com/~ruari/censorship.html for instructions. Basically you just set a port on your local machine which looks like a SOCKS5 proxy. Then configure your browser to use localhost:port as the proxy.

I would think twice before doing such a thing. In some environments, such bypassing of corporate security is grounds for dismissal.

share|improve this answer
    
+1 for the think twice :) –  Frenchie Jul 30 '09 at 14:23
    
Yes, especially when it becomes obvious because your computer is the largest source of viruses on the network... –  Ernie Jul 30 '09 at 16:06
add comment

With normal port forwarding you would only be able to browse one site that way.

If you can edit your local proxy settings (which I doubt you can) then you could run a proxy on the SSH server end and port-forward to that.

Some SSH clients and servers support lower level VPN like arrangements, but unless you have full admin control (which I'm guessing you don't as your description implies a very locked down environment) .

One solution would be to use port-forward to gain access to a machine at the remote end that is running VNC or RDC or similar. Once you have remote control over that machine you can browse using it, though this will be slower of course.

share|improve this answer
    
Actually, I can edit my local proxy settings, I also have local full admin control. –  David Jul 30 '09 at 14:36
    
In that case run a proxy on your Linux box, banu.com/tinyproxy for example which if you run Debian you find in the "tinyproxy" package, tunnel the port it listens on (8888 is common) over your SSH link, and set your browser to use that 127.0.0.1:<port> as the HTTP proxy. –  David Spillett Jul 30 '09 at 15:20
    
A warning though: if you are doing this to get around an employers restrictions then you could fact the sack if you are spotted as this would be considered hacking around their security. Depending on your place of work you may open yourself to more serious accusations too (some places need to control external access from internal workstations for regulatory reasons, so you could be breaking the law not just breaking company rules). –  David Spillett Jul 30 '09 at 15:23
add comment

You may be unfortunate enough to actually be under a Deep Packet Inspection router, in which case your SSH traffic over ANY port would be discarded.

The solution to THAT problem is STunnel in combination with SSH.

An easy to set up and use proxy I personally use is privoxy.org.

share|improve this answer
add comment

This old but good lifehacker article has very user friendly tutorial on how to do this in with Windows. PLUG_ALERT: Here is another tutorial, written by, well, me :-)

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.