topic Re: ssh tunnel in Operating System - Linux

ssh tunnel

Piotr Kirklewski — Thu, 27 Jan 2011 14:30:51 GMT

Hi there

My network looks like this:

LAPTOP
|
|
INTERNET
|
gateway (nat points to port 80 @ webserver1)
|
|___webserwer1(port 80)
|
|___webserver2 (port 80)

I need to be able to reach the webpages @ webserver2 from my laptop while out of the building and I can ssh to the machine.

I'm building VPN but in the meantime - how to create a ssh tunnel to be able to browse pages on webserver2 ?

Reagrds

Peter

Re: ssh tunnel

Tim Nelson — Thu, 27 Jan 2011 16:26:35 GMT

configure ssh client with X11 forwarding enabled.

ssh to webserver2

start X11 server on laptop

run firefox from server

Re: ssh tunnel

Jimmy Vance — Fri, 28 Jan 2011 00:56:02 GMT

ssh -L 80::80 username@webserver2.system

Point your browser to http://localhost to get to the web pages on webserver2

Re: ssh tunnel

Matti_Kurkela — Fri, 28 Jan 2011 12:24:46 GMT

Since gateway includes NAT, a direct SSH connection from LAPTOP to webserver2 might not be possible.

In that case:

ssh -L 8080:webserver2:80 gateway

Then type this URL to your browser:

http://localhost:8080

The browser will connect to SSH tunnel set up by your SSH client at localhost:8080. The traffic will be passed to sshd on gateway wrapped within the encrypted SSH protocol. On gateway, the sshd makes a regular, unencrypted TCP connection to port 80 of webserver2 and passes the tunneled traffic to it.

If your SSH is not very old, it probably supports dynamic tunneling too.

On LAPTOP, start a dynamic SSH tunnel like this:

ssh -D 8080 gateway

Then configure your web browser to use a SOCKS proxy at localhost, port 8080.

Now all the connections made by your web browser are first tunneled by SSH to gateway, and will proceed from there to their destination. So you can use a regular URL like this:

http://webserver2/

This may make things much easier if the content of webserver2 includes a lot of absolute URLs.

(NOTE: if the IP address of webserver2 is not resolvable by LAPTOP, you may have to use webserver2's IP address instead of the hostname.)

Remember to remove the SOCKS proxy specification from your browser's configuration when you're done, or you'll eventually spend some time wondering why your browser won't work.

If you can directly SSH from LAPTOP to webserver2, you can replace all instances of "gateway" in command examples above with "webserver2".

MK