Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I've a remote server which is not connected to the internet, but I can connect from via SSH to it through a VPN tunnel. On this client I got internet. Is it possible 'get internet' from the client through the VPN conection? The server is a Debian 7 machine.

share|improve this question

4 Answers 4

f your server is running a recent sshd version ( >= 4.3 ) you should be able to use the ssh IP tunneling option "-w" and set up a point-to-point connection. After that it is just a matter of routing.
(As your server is only reachable through the network beware to not cut the link when setting the routes. For instance open a new ssh connection to your server from another server connected to the same lan. Local routes are unaffected so you will not risk to cut the connection even if you remove the default gateway.)

see doccumentation here

extract :

    +---------------+            OpenSSH 4.3           +---------------+
    |   Machine A   | tun0 -- Tunnel Interface -- tun0 |   Machine B   |
    |  Has a tunnel | <------------------------------->|  Has a tunnel |  
    |  and ethernet | 10.0.0.100            10.0.0.200 |  and ethernet |
    +-------+-------+     point to point connection    +-------+-------+
       eth0 |                 creates a bridge                 | eth0  
 10.0.0.100 |               that plugs machine B               | 192.168.0.100
   port 22  |                  into network A                  |          
  forwarded |                                                  |
    here    |                                                  |
    +-------+-------+          +-~-~-~-~-~-~-~-+       +-------+-------+ 
    |   Network A   |          |               |       |   Network B   |
    |  10.0.0.1/24  | 1.2.3.4  |  The Internet |       | 192.168.0.1/24|
    |  Has internet |<-------->|               |<----->|  Has internet |
    |  NAT gateway  | Routable |               |       |  NAT gateway  |
    +---------------+ Address  +-~-~-~-~-~-~-~-+       +---------------+

EDIT

An alternative is to use a proxy for port forwarding

This will open an local SOCKS proxy :

ssh -TND 127.0.0.1:1080  localuser@localhost

This open a shell on the remote host and a tunnel to your proxy (unfortunately the -D cannot be set remotly)

ssh -R 127.0.0.1:1080:127.0.0.1:1080 remoteuser@remotehost

That will works with firefox and gnome; if your application is not socks aware wrap it with tsocks

$ sudo -s 
# cat >/etc/tsocks.conf <<eof
server = 127.0.0.1
server_type = 5
server_port = 1080
eof

# tsocks apt-get update 
share|improve this answer
    
To me, this seems like overkill to simply get internet. However it does have the advantage of not needing to install anything on the client side. –  Lawrence Feb 12 at 1:27
    
@Lawrence the question was to get Internet, Internet is connecting networks with IP. But if you prefer a port forwarding solution I will add that alternative (without additional software too) –  Emmanuel Feb 12 at 14:45
    
From the way the question was phrased, I was under the impression that the only thing that's needed is web access. Of course I could be wrong and your answer could well be the correct one in this situation. –  Lawrence Feb 12 at 15:20

You could install a http proxy (like squid) on the client that is accessing this server, and then tunnel traffic back through the ssh connection to the client and then through the proxy.

Something like this

             +----------+            +-----------+
             |          |+----SSH+-->|           |
             |  Client  |            | Server    |
             |+--------+|            |           |
  Internet <-++-+PROXY<++<SSH Tunnel--+          |
             |+--------+|            |           |
             +----------+            +-----------+

Sshing to the server would go something like this
ssh -R 3128:127.0.0.1:3128 user@server

Then on the server, you would setup apt to use a proxy with the address and port of 127.0.0.1:3128

Adding the following line into /etc/apt/apt.conf should do the trick
Acquire::http::Proxy "http://127.0.0.1:3128";

share|improve this answer
    
Seems like the wrong tunnel option to ssh: -L would forward the client port to the server, which is the opposite operation. -R would forward the server port to the client. –  Stabledog Feb 21 at 6:33
    
Option -L opens the local port (on the server) 3128 to remoteserver:remote port. In this case, the remote server is the client machine itself, hence 127.0.0.1. Option -R Opens the port on the remote server (in this case the client) and allows connects back to the server on a certain port. –  Lawrence Feb 21 at 13:34
    
Sounds like we agree on the directionality, but your description seems ambiguous: -L allows the client to do a local open, and that open call is forwarded to the server. That's the opposite of what your drawing suggests: the server needs to open a port on the client, thus the need for -R. (Source: I do this all the time on a daily basis... :) –  Stabledog Feb 21 at 18:41
    
Yes, you are correct. Getting my directions mixed up. –  Lawrence Feb 24 at 13:11

You could install squid on your machine and then:

sudo apt-get install squid
sudo /etc/init.d/squid restart
ssh -L3128:127.0.0.1:3128 host

And once inside:

export http_proxy=http://127.0.0.1:3128/
export https_proxy=http://127.0.0.1:3128/
export ftp_proxy=http://127.0.0.1:3128/ (not Sure)
and try: apt-get update

It should work.

share|improve this answer

Maybe you can install a proxy on the server to access internet and modify apt to connect using http proxy, adding entries in /etc/apt/apt.conf

Acquire::http::Proxy "http : //user:password@ServerIP:Port";

I'm telling this because is the way I am getting all the updates in my company. Here we have configured squid as http proxy.

Best of luck!

share|improve this answer
    
I've updated my question. It isn't only about downloading software (which I first said) but it is about connection to the Internet. –  OrangeTux Feb 11 at 8:31
    
You can configure your default gateway to route the traffic using the VPN address as GW and in the server create a rule to redirect the traffic from your pc to the address. I don't have enough rep to add multiple references, but I searched in google for "redirect traffic iptables" and for "set default gateway linux" and there are two good articles. Sorry I can not link my rep is too low :(. Maybe you have to take care of destination and source natting. –  Raistmaj Feb 11 at 8:40

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.