Say I have a computer inside a typical home router (but say firewall/port forwarding access to the router is not available). It's internal IP can be 192.168.1.81. There is an attacker machine on that LAN with the IP 192.168.1.85 that wants to do a typical ARP spoofing MITM attack on 192.168.1.81 (say he wants to run something like urlsnarf to sniff for visited websites). The 192.168.1.81 machine wants to prevent any form of MITM attack and stay secure when browsing the internet on Chrome. He has a server with SSH access that he wants to use to encrypt his web browsing so the attacker cannot sniff it with a MITM attack. How can I (the user who wishes to use SSH tunneling to stay secure) use SSH tunneling on my server (at public IP 162.xx.xxx.xx) to prevent the potential MITM attack? This is for a science fair project. What (if any) settings would I have to make on my server (I have full root access)? My SSH port is different than the norm, so please make the SSH port 25512 as reference. I have also opened port 4567 on the firewall for the server, so please use that port for reference as well. Please use 72.xxx.xx.xxx as the public IP for the home network. Please include any commands necessary. Let me know if I need to be more clear. Thank you very much to anyone who can help!
The easiest way is to run a proxy (f.e. squid) on your remote server and make it listen only on the local interface
127.0.0.1 (because you don't want to open a proxy to the internet).
Then you ssh into the remote server and create a tcp forwarding to the local proxy interface on the remote server.
For example, lets say your proxy on the remote server
162.xx.xx.xx is listening on tcp
127.0.0.1:3128. Now you could connect to it with ssh with this command:
ssh -p 25512 -L 3128:127.0.0.1:3128 -C 162.xx.xx.xx
This opens a tunnel from your client's
127.0.0.1:3128 to the remote hosts
127.0.0.1:3128. Then you can simply set your browser on the client to use the proxy
127.0.0.1:3128 which is then tunneled via ssh to the remote host and passed into the proxy there.
-C parameter enables compression and should hopefully make your browsing a little faster because less data has to be transmitted.
These are the relevant parts of
man 1 ssh:
-L [bind_address:]port:host:hostport Specifies that the given port on the local (client) host is to be forwarded to the given host and port on the remote side. This works by allocating a socket to listen to port on the local side, optionally bound to the specified bind_address. Whenever a connection is made to this port, the connection is forwarded over the secure channel, and a connection is made to host port hostport from the remote machine. Port forwardings can also be specified in the configuration file. IPv6 addresses can be specified by enclosing the address in square brackets. Only the superuser can forward privileged ports. By default, the local port is bound in accordance with the GatewayPorts setting. However, an explicit bind_address may be used to bind the connection to a specific address. The bind_address of “localhost” indicates that the listening port be bound for local use only, while an empty address or ‘*’ indicates that the port should be available from all interfaces. -C Requests compression of all data (including stdin, stdout, stderr, and data for forwarded X11 and TCP connections). The compression algorithm is the same used by gzip(1), and the “level” can be controlled by the CompressionLevel option for protocol version 1. Compression is desirable on modem lines and other slow connections, but will only slow down things on fast networks. The default value can be set on a host-by-host basis in the configuration files; see the Compression option. -p port Port to connect to on the remote host. This can be specified on a per-host basis in the configuration file.