Connect to the Internet on a VPN connected server without Internet

Question

I've a remote server which is not connected to the internet, but I can connect from via SSH to it through a VPN tunnel. On this client I got internet. Is it possible 'get internet' from the client through the VPN conection? The server is a Debian 7 machine.

Answer 1

f your server is running a recent sshd version ( >= 4.3 ) you should be able to use the ssh IP tunneling option "-w" and set up a point-to-point connection. After that it is just a matter of routing.
(As your server is only reachable through the network beware to not cut the link when setting the routes. For instance open a new ssh connection to your server from another server connected to the same lan. Local routes are unaffected so you will not risk to cut the connection even if you remove the default gateway.)

see doccumentation here

extract :

    +---------------+            OpenSSH 4.3           +---------------+
    |   Machine A   | tun0 -- Tunnel Interface -- tun0 |   Machine B   |
    |  Has a tunnel | <------------------------------->|  Has a tunnel |  
    |  and ethernet | 10.0.0.100            10.0.0.200 |  and ethernet |
    +-------+-------+     point to point connection    +-------+-------+
       eth0 |                 creates a bridge                 | eth0  
 10.0.0.100 |               that plugs machine B               | 192.168.0.100
   port 22  |                  into network A                  |          
  forwarded |                                                  |
    here    |                                                  |
    +-------+-------+          +-~-~-~-~-~-~-~-+       +-------+-------+ 
    |   Network A   |          |               |       |   Network B   |
    |  10.0.0.1/24  | 1.2.3.4  |  The Internet |       | 192.168.0.1/24|
    |  Has internet |<-------->|               |<----->|  Has internet |
    |  NAT gateway  | Routable |               |       |  NAT gateway  |
    +---------------+ Address  +-~-~-~-~-~-~-~-+       +---------------+

EDIT

An alternative is to use a proxy for port forwarding

This will open an local SOCKS proxy :

ssh -TND 127.0.0.1:1080  localuser@localhost

This open a shell on the remote host and a tunnel to your proxy (unfortunately the -D cannot be set remotly)

ssh -R 127.0.0.1:1080:127.0.0.1:1080 remoteuser@remotehost

That will works with firefox and gnome; if your application is not socks aware wrap it with tsocks

$ sudo -s 
# cat >/etc/tsocks.conf <<eof
server = 127.0.0.1
server_type = 5
server_port = 1080
eof

# tsocks apt-get update 

Answer 2

You could install a http proxy (like squid) on the client that is accessing this server, and then tunnel traffic back through the ssh connection to the client and then through the proxy.

Something like this

             +----------+            +-----------+
             |          |+----SSH+-->|           |
             |  Client  |            | Server    |
             |+--------+|            |           |
  Internet <-++-+PROXY<++<SSH Tunnel--+          |
             |+--------+|            |           |
             +----------+            +-----------+

Sshing to the server would go something like this
ssh -R 3128:127.0.0.1:3128 user@server

Then on the server, you would setup apt to use a proxy with the address and port of 127.0.0.1:3128

Adding the following line into /etc/apt/apt.conf should do the trick
Acquire::http::Proxy "http://127.0.0.1:3128";

Answer 3

You could install squid on your machine and then:

sudo apt-get install squid
sudo /etc/init.d/squid restart
ssh -L3128:127.0.0.1:3128 host

And once inside:

export http_proxy=http://127.0.0.1:3128/
export https_proxy=http://127.0.0.1:3128/
export ftp_proxy=http://127.0.0.1:3128/ (not Sure)
and try: apt-get update

It should work.

Answer 4

Maybe you can install a proxy on the server to access internet and modify apt to connect using http proxy, adding entries in /etc/apt/apt.conf

Acquire::http::Proxy "http : //user:password@ServerIP:Port";

I'm telling this because is the way I am getting all the updates in my company. Here we have configured squid as http proxy.

Best of luck!