problem: I need create ssh forwarding to other linux box that works as a proxy.

I have two linux boxes(centos 5.5), one in the office(server1) behind firewall, other at colocation(server2)

server1 has squid proxy instaled on port 3128.

i cant use server1 as a direct proxy from home because its behind firewall.

iwas able to create ssh tunnel from server1 to server2 and when i log in to server2 ican ssh root@localhost -p 12312 to server1

what i need is configure server2 so it forwards port server2:3128 to server1:3128

and i could add server2 ip addres and port to firefox proxy's and access ofice network.



the guess work

If I understand you correctly you want to connect from your client with a browser to server2, which then tunnels the connection to server1 and thus allows you to access the office net via the squid-proxy installed on server1.

just to get the guess work complete I think you used something like

server1$ ssh -R 12312:localhost:22 server2

to setup the first tunnel.

a solution attempt

if you really want to be able to enter server2 as a proxy in your client's firefox settings make sure that in server2's sshd_config (/etc/ssh/sshd_config) GatewayPorts is enabled:

 GatewayPorts yes

also make sure that no blocking iptables rules are in place for the ports you want to use.

then instead of your existing tunnel you could use:

server1$ ssh -R *:3128:localhost:3128 server2

or if you really want to use your existing tunnel you could use:

server2$ ssh -L *:3218:localhost:3218 -p 12312 localhost

some side notes

If you do it in the way explained above everyone who can reach server2 (no login required) can use port 3128 as proxy port and thus access your office net (if no other measures are in place)

I don't know what kind of policies exist in your company but before attempting such tunnels make sure you don't break any.

another solution

change your existing tunnel to

server1$ ssh -R 3128:localhost:3128 server2

from your client issue a

client$ ssh -L 3218:localhost:3128 server2

then in your firefox add localhost and port 3128 as proxy config.

like this you don't need the configuration of GatewayPorts and only people with a login on server2 can use the tunnel to server1

| improve this answer | |
  • Congrats on figuring out the question :-) – ℝaphink May 25 '11 at 14:29
  • +1 for this answer :) – Edmhs May 25 '11 at 17:43
  • did it solve your problem? – Marcel G May 26 '11 at 8:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.