Here's my situation.

  • At work there's an internal network.
  • I can access the work network from home by ssh'ing to a linux box that faces both the internet and the internal network.
  • The work network has another linux box running a web server.
  • I want to connect to the web server on the second linux box with my windows box at home.
  • The web server uses many vhosts.
  • My home network uses ip addresses like
  • My work networks uses up addresses like

I think I can achieve this using ssh tunnels but I'm not clear on what settings to use in Putty and I'm not sure what to put in my hosts file for the vhosts.

Thanks for the help!


5 Answers 5


Okay... This is very possible with Putty though not as easy as with OpenSSH on a Linux machine. I would very much recommend setting up an SSH identity key and installing it on the boxes that you are connecting to and use the Putty Agent (pagent.exe) key forwarding agent. That said here is the steps to take.

First, create a Putty connection profile for your work Linux box that you can reach from home. You'll want to be sure under Connection -> Data that you set your Auto-login username. Then under Connection -> SSH -> Auth be sure that Allow agent forwarding is checked. Now save this profile and make note of the name you call it (ie- work-jumpbox).

With this setup you now want to setup a second profile for the box behind the work jumpbox. Set this profile up with the correct host name/IP address and port of the webserver in the office. You then want to go to Connection -> Data -> Proxy and set the Proxy Type to local and set the Telnet command or local-proxy-command to plink -load work-jumpbox -nc %host:%port\n (replace work-jumpbox with whatever you called your previous profile for the work linux box.

Now save this profile (ie- work-webserver) and when you want to connect to it load it and click connected it should log you into the office web server after it logs into the jumpbox silently.


I suppose your web server is running at the address on the port 80 in your company network.

  1. Open your SSH connection to your first linux box with putty.
  2. Go to the menu Connection > SSH > Tunnels.
  3. Enter into the textbox Source port the port 1234 (you can use any other port if you want, as long as it is not already used by a local service, and bigger than 1024 if you are not admin on your machine).
  4. In the field Destination, enter the address and the port of your web server:
  5. Click on the button Add

Now if you type http://localhost:1234/ in your browser, you should get the page of the default virtual host of your web server. Just add the following line in your hosts file myvhost.com

and you will access your web site with the following URL in your browser http://myvhost.com:1234/

  • His web server isn't running ssh. Can't tunnel directly to it. Sep 4, 2010 at 20:46
  • The first linux box is the server on which he can open an SSH connection. The second linux box is the web server at the address
    – uloBasEI
    Sep 4, 2010 at 20:53
  • Ah I see what you're doing. Similar to what I'm doing though I like using the command line to establish the connection. Sep 4, 2010 at 21:34

First go into putty and set up a saved connection to your ssh server at the office. Let's say for the sake of the rest of the instructions you name it "office"

Open up a command window and do the following where X is the last octet of the IP in your web server.

putty -L 80:192.168.0.X:80 -load office -N

This command uses the SSH session "office" and maps your local port 80 to the remote port 80 of the web server tunneled through the "office" server.

Now if you want to connect to a specific host name you'd want to add it into your hosts table and point it to your localhost.


That 'should' do it.


Use a SOCKS proxy. Open the PuTTY window and go to Connections->SSH->Tunnels (it might be slightly different as I don't have access to a PuTTY atm). Type the source port as 8080, select the options Dynamic and Automatic and click "Add" (you don't need a destination port for dynamic) and connect to the SSH server.

Then go into Firefox Tools -> Advanced -> Network -> Settings for Configure how Firefox connects to the Internet -> Manual Proxy Configuration -> leave all the fields blank except for SOCKS Host, which should be localhost on port 8080. Set No Proxy For to and click Apply. Everything except your local internet network should now be sent via that server.

On Linux it's Edit -> Preferences -> Advanced -> Network -> Settings in Firefox.


This can be done with SSH Tunnels, but its really not a great solution. Essentially it breaks down to you passing TCP packets over a TCP connection, which can explode if your connection is not close to perfect.

A much better approach would be to set up a VPN, which uses UDP packets, and when you log in to the VPN, you can see the work's network as if you were logged in at the office. OpenVPN is great for this purpose, and its site has very thorough guides to help get you set up.

  • Quite a bit of misinformation here. I use SSH tunnels for this sort of thing very often over crappy internet connections and know many others that do as well, and very, very rarely have problems. I'm not quite sure whant you mean by "explode". Sure, if it starts dropping packets, you'll have some performance degredation, but that'll happen with UDP as well. Second, setting up a VPN does not ensure you'll be using UDP, as most VPN transports can use either UDP or TCP.
    – EEAA
    Sep 4, 2010 at 21:29
  • I agree with ErikA. I use this sort of thing all the time, even from a verizon wireless card while on the road. I have VPN's set up to my office and to production, and I prefer a VPN for secure locations... but I have an SSH server at home for just this sort of thing. Sep 4, 2010 at 21:36
  • I read a paper on it about a year ago, talking about how the windowing between the TCP packets on the ssh connection, and the TCP packets you are tunneling. I'm currently trying to track it down, but having some difficulty. Sep 5, 2010 at 1:05
  • I'm sure that one could find papers speaking for or against any technology out there if you look hard enough. I'm speaking from over a decade of personal experience using these technologies. That experience says that tunneling TCP over SSH works very well 99.9% of the time.
    – EEAA
    Sep 5, 2010 at 1:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.