The isp I am currently connected to only has port 80 open, but I need to ssh to my server which listens on port 22 of my router there. Is there a way to go out through port 80 here, then in through 22 there?

  • 1
    Do you really have outbound port 80, and not all ports block but a (possibly transparent) proxy that only allows HTTP traffic? (Usually the proxy also relays HTTPS, and it's not too difficult to make SSH pass off as HTTPS unless your institution has the horrible idea to use fake certs.) – Gilles 'SO- stop being evil' Jan 16 '14 at 23:55
  • They use no CA certificates... it's really weird. – Peace Blaster Jan 17 '14 at 5:40

Is weird that your outbound only allows port 80, but whatever. You can redirect all connections to port 80 to port 22 using iptables or make the SSH server listen the port 80 too.

Using iptables:

iptables -t nat -I PREROUTING --src 0/0 --dst YOURSERVERIP -p tcp --dport 80 -j REDIRECT --to-ports 22

Modifying your server ssh configuration:

sed '/\#Port\ 22/Port 80/' /etc/ssh/sshd_config | grep 80

If everything is ok, use:

sudo sed -i '/\#Port\ 22/Port 80/' /etc/ssh/sshd_config
  • could I make the IPtables set up from that unique to ssh? I don't want my web browsing and irc to go out the window with it lol – Peace Blaster Jan 17 '14 at 5:40
  • Found this: wiki.archlinux.org/index.php/… but am not sure how secure my ssh connection will be after that – Peace Blaster Jan 17 '14 at 5:49

First off I feel like I am reading your question incorrectly. I understand it as saying that you are only allowed outbound traffic on port 80. This means to me that you need to communicate from port 80 to your servers port 22. Fortunately, this is completely possible using backpipes and netcat. Here is the process:

First, create your backpipe:

# mknod backpipe p

Next, make a netcat listener that connects your backpipe and sends the information out the port of your choosing (80), to a port of your choosing (22):

# nc -l -p 222 0<backpipe | nc -p 80 SERVERIP 22 | tee backpipe

Finally, just connect to your listening port!

# ssh server_username@ -p 222

Here's a breakdown of the backpipe line for the curious:

nc -l -p 222 0<backpipe

This sets up a netcat listener that listens on port 222 (you can change this to whatever port you want, I just picked 222) and sends all the data into your backpipe.

nc -p 80 SERVERIP 22

This sets a source port of 80 to SERVERIP port 22. This is the connection the OP wanted in his post, but we want to shuttle an SSH connection through this, thus the need for a backpipe.

tee backpipe

This sends your STDOUT to the backpipe, and also to your terminal. If you don't want to see the data you could replace it with this line:

# nc -l -p 222 0<backpipe | nc -p 80 SERVERIP 22 1> backpipe
  • (1) What are you saying about < and backpipe?  Of course there can be space(s) between a < (or >) and the following filename.  (2) 0 is the default file descriptor for <, and 1 for > — it’s quite enough to say < backpipe and > backpipe.  (3) Would you please clarify what command(s) need to be performed as root and which ones don’t.  I’m guessing that % sudo nc -l -p 222 < backpipe | sudo nc -p 80 SERVERIP 22 | tee backpipe would work. – G-Man Says 'Reinstate Monica' Apr 16 '16 at 2:08
  • Wildcard fixed it. I was talking about Markdown breaking my formatting, but you're absolutely right about the spaces being inconsequential. – MikeTGW Apr 16 '16 at 2:15
  • 3) You would have have to run the "nc -p 80 SERVERIP 22" portion as root, in order to utilize a priviledged port. You don't have to be root to use mknod. If you wanted to limit the sudo-ing you could do nc -l -p 8888 < backpipe | sudo nc -p 80 SERVERIP 22 | tee backpipe – MikeTGW Apr 16 '16 at 2:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.