2

Say I have a computer inside a typical home router (but say firewall/port forwarding access to the router is not available). It's internal IP can be 192.168.1.81. There is an attacker machine on that LAN with the IP 192.168.1.85 that wants to do a typical ARP spoofing MITM attack on 192.168.1.81 (say he wants to run something like urlsnarf to sniff for visited websites). The 192.168.1.81 machine wants to prevent any form of MITM attack and stay secure when browsing the internet on Chrome. He has a server with SSH access that he wants to use to encrypt his web browsing so the attacker cannot sniff it with a MITM attack. How can I (the user who wishes to use SSH tunneling to stay secure) use SSH tunneling on my server (at public IP 162.xx.xxx.xx) to prevent the potential MITM attack? This is for a science fair project. What (if any) settings would I have to make on my server (I have full root access)? My SSH port is different than the norm, so please make the SSH port 25512 as reference. I have also opened port 4567 on the firewall for the server, so please use that port for reference as well. Please use 72.xxx.xx.xxx as the public IP for the home network. Please include any commands necessary. Let me know if I need to be more clear. Thank you very much to anyone who can help!

2
  • Upvote for a fairly articulate question. Next time, you might want to include if you yourself has done any research pertinent to the problem. Just a tip ;) Jan 1, 2014 at 8:44
  • This question probably best belongs on security.stackexchange.com.
    – Ladadadada
    Jan 9, 2014 at 15:16

1 Answer 1

5

The easiest way is to run a proxy (f.e. squid) on your remote server and make it listen only on the local interface 127.0.0.1 (because you don't want to open a proxy to the internet).

Then you ssh into the remote server and create a tcp forwarding to the local proxy interface on the remote server.

For example, lets say your proxy on the remote server 162.xx.xx.xx is listening on tcp 127.0.0.1:3128. Now you could connect to it with ssh with this command:

ssh -p 25512 -L 3128:127.0.0.1:3128 -C 162.xx.xx.xx

This opens a tunnel from your client's 127.0.0.1:3128 to the remote hosts 127.0.0.1:3128. Then you can simply set your browser on the client to use the proxy 127.0.0.1:3128 which is then tunneled via ssh to the remote host and passed into the proxy there.

The -C parameter enables compression and should hopefully make your browsing a little faster because less data has to be transmitted.

These are the relevant parts of man 1 ssh:

 -L [bind_address:]port:host:hostport
         Specifies that the given port on the local (client) host is to be forwarded to 
         the given host and port on the remote side.  This works by allocating a socket 
         to listen to port on the local side, optionally bound to the specified 
         bind_address.  Whenever a connection is made to this port, the connection is 
         forwarded over the secure channel, and a connection is made to host port 
         hostport from the remote machine.  Port forwardings can also be specified in 
         the configuration file.  IPv6 addresses can be specified by enclosing the 
         address in square brackets.  Only the superuser can forward privileged ports. 
         By default, the local port is bound in accordance with the GatewayPorts 
         setting.  However, an explicit bind_address may be used to bind the connection 
         to a specific address.  The bind_address of “localhost” indicates that the 
         listening port be bound for local use only, while an empty address or ‘*’ 
         indicates that the port should be available from all interfaces.

 -C      Requests compression of all data (including stdin, stdout, stderr, and data for
         forwarded X11 and TCP connections).  The compression algorithm is the same used
         by gzip(1), and the “level” can be controlled by the CompressionLevel option 
         for protocol version 1.  Compression is desirable on modem lines and other slow 
         connections, but will only slow down things on fast networks.  The default 
         value can be set on a host-by-host basis in the configuration files; see the 
         Compression option.

 -p port
         Port to connect to on the remote host.  This can be specified on a per-host 
         basis in the configuration file.
3
  • Thank you for the quick answer! Do you know a simple way (perhaps a link to a guide, tutorial, or article) to configure Squid for this purpose?
    – DrDinosaur
    Jan 1, 2014 at 8:12
  • I don't know a guide, but it should be really simple. Basically you only need to install the package and then edit the http_port parameter, change it's value to 127.0.0.1:3128 and restart squid. Here is the according doc: squid-cache.org/Doc/config/http_port
    – replay
    Jan 1, 2014 at 8:16
  • Wow, thank you so much. This really works perfectly! Very simple and effective! I ran the command, entered my password, setup the proxy in Chrome and my IP changed to that of my server. I checked Wireshark and when I had the http filter set, I could see the activity without the proxy, but there was nothing when the proxy was on. Very nice!
    – DrDinosaur
    Jan 1, 2014 at 10:38

Not the answer you're looking for? Browse other questions tagged .