ssh tunnel

[Piotr Kirklewski]

Hi there

My network looks like this:

LAPTOP
|
|
INTERNET
|
gateway (nat points to port 80 @ webserver1)
|
|___webserwer1(port 80)
|
|___webserver2 (port 80)

I need to be able to reach the webpages @ webserver2 from my laptop while out of the building and I can ssh to the machine.

I'm building VPN but in the meantime - how to create a ssh tunnel to be able to browse pages on webserver2 ?

Reagrds

Peter

[Tim Nelson]

configure ssh client with X11 forwarding enabled.

ssh to webserver2

start X11 server on laptop

run firefox from server

[Jimmy Vance]

ssh -L 80::80 username@webserver2.system


Point your browser to http://localhost to get to the web pages on webserver2

[Matti_Kurkela · Accepted solution]

Since gateway includes NAT, a direct SSH connection from LAPTOP to webserver2 might not be possible.

In that case:

ssh -L 8080:webserver2:80 gateway

Then type this URL to your browser:

http://localhost:8080

The browser will connect to SSH tunnel set up by your SSH client at localhost:8080. The traffic will be passed to sshd on gateway wrapped within the encrypted SSH protocol. On gateway, the sshd makes a regular, unencrypted TCP connection to port 80 of webserver2 and passes the tunneled traffic to it.


If your SSH is not very old, it probably supports dynamic tunneling too.

On LAPTOP, start a dynamic SSH tunnel like this:

ssh -D 8080 gateway

Then configure your web browser to use a SOCKS proxy at localhost, port 8080.

Now all the connections made by your web browser are first tunneled by SSH to gateway, and will proceed from there to their destination. So you can use a regular URL like this:

http://webserver2/

This may make things much easier if the content of webserver2 includes a lot of absolute URLs.

(NOTE: if the IP address of webserver2 is not resolvable by LAPTOP, you may have to use webserver2's IP address instead of the hostname.)

Remember to remove the SOCKS proxy specification from your browser's configuration when you're done, or you'll eventually spend some time wondering why your browser won't work.


If you can directly SSH from LAPTOP to webserver2, you can replace all instances of "gateway" in command examples above with "webserver2".

MK