2

I have a little service which listen only on https://localhost:41952 and checks source hostname (it must be localhost). I want to connect on "listen:1988" and redirect requests with stunnel to "localhost:41952"

https://192.168.1.10:1988 -> redirect https://localhost:41952

current config:

[myservice]
cert = stunnel.pem
accept = 0.0.0.0:1988
connect = localhost:41952

openssl_client log:

http://pastebin.com/7bg3sf7J

Please note that this certificate is different, than it is on localhost:41952.

curl test:

$ curl https://192.168.1.17:1988/DYMO/DLS/Printing/Check -vk
*   Trying 192.168.1.17...
* Connected to 192.168.1.17 (192.168.1.17) port 1988 (#0)
* TLS 1.2 connection using TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
* Server certificate: localhost
> GET /DYMO/DLS/Printing/Check HTTP/1.1
> Host: 192.168.1.17:1988
> User-Agent: curl/7.43.0
> Accept: */*
> 

waiting forever.

Maybe I need client = yes? But I don't have any certificate, unless which I exported from Firefox on the site of the service https://localhost:41952

My original question:

Free reverse proxy with SSL for Windows

3 Answers 3

3

stunnel is a program to create a gateway between non-SSL and SSL. From the description on the home page:

Stunnel is a proxy designed to add TLS encryption functionality to existing clients and servers without any changes in the programs' code

This tool is not designed to create a gateway from SSL to SSL. What you need in your case is just a simple TCP forwarder which can be done with socat:

socat TCP4-LISTEN:1988,fork TCP4:127.0.0.1:41952

With this forwarder the connection to 192.168.1.17:1988 gets forwarded to 127.0.0.1:41952. The client will get the original certificate from the server because the forwarding is done at the TCP level. The server will see the connection coming from 127.0.0.1.

EDIT: after lots of communication it is now clear that the aim is not to have the right source hostname es claimed and in the question and not the right Referer as claimed in a response but that the Host HTTP request header has the expected value 'localhost'. Since the host header is set from the URL you would need to make sure that the request gets forwarded to the remote system and the browser is not trying to resolve the URL by itself, because otherwise it would try to connect to server on the machine where the browser is running. To defer the resolving of the URL to the target system you need to run a proxy there, i.e. either something like Charles Proxy which you've tried or some SOCKS proxy.

8
  • Originally I am looked for a reverse SSL proxy, the stunnel was recommended here: serverfault.com/questions/727751/… - Is there any Windows equivalent to socat?
    – user66638
    Oct 9, 2015 at 11:55
  • @user66638: linuxtechres.blogspot.de/2010/10/…. And the question you refer to is about forwarding SSL->TCP, not SSL->SSL or TCP->TCP. Oct 9, 2015 at 12:15
  • Thank you. I tried out, but it is change the referrer's hostname. It must be localhost, this is why I am looking for a reverse proxy.
    – user66638
    Oct 9, 2015 at 12:48
  • @user66638: Now I see what you problem is and it has nothing to do with what you described. A proxy will not help here because it does not change the Referer-Header of the HTTP request. To manipulate the header with curl just use curl -e http://localhost/. Oct 9, 2015 at 13:08
  • Hmmm. The only thing what is worked is the Charles Proxy -> dropbox.com/s/fbcza7sos1dxj7w/… and dropbox.com/s/7bttou72qwhkqt7/… - With this two setting I am abble to connect from any remote device. I do not want to believe that this can be achieved only by this program.
    – user66638
    Oct 9, 2015 at 14:31
1

So to connect to https://192.168.1.10:1988 and reach SSL service that listens on port 4952 of loopback interface on host with IP 192.168.1.10:

We need to 2 stunnel stanzas to achive what we want.

[myservice]
cert = stunnel.pem
client = no
accept = 0.0.0.0:1988
connect = localhost:1987

[myserviceaux]
cert = stunnel.pem
client = yes
accept = localhost:1987
connect = localhost:4952

The only thing what I cannot achieve is to modify header host to localhost for all request in stunnel.

From curl it's working perfectly:

$ curl https://192.168.1.10:41951/DYMO/DLS/Printing/Check -k -H "Host: localhost"
1
  • thanks for your answer, it worked very well in my case! you saved my day! Jan 8, 2019 at 14:14
0

I've solved a similar HTTPS-TO-HTTPS problem on Windows with this command:

netsh interface portproxy add v4tov4 listenport=443 listenaddress=127.0.0.1 connectport=[remote-https-port] connectaddress=[remote-ip]

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .