I've a remote server which is not connected to the internet, but I can connect from via SSH to it through a VPN tunnel. On this client I got internet. Is it possible 'get internet' from the client through the VPN conection? The server is a Debian 7 machine.
4 Answers
f your server is running a recent sshd version ( >= 4.3 ) you should be able to use the ssh IP tunneling option "-w" and set up a point-to-point connection. After that it is just a matter of routing.
(As your server is only reachable through the network beware to not cut the link when setting the routes. For instance open a new ssh connection to your server from another server connected to the same lan. Local routes are unaffected so you will not risk to cut the connection even if you remove the default gateway.)
extract :
+---------------+ OpenSSH 4.3 +---------------+
| Machine A | tun0 -- Tunnel Interface -- tun0 | Machine B |
| Has a tunnel | <------------------------------->| Has a tunnel |
| and ethernet | 10.0.0.100 10.0.0.200 | and ethernet |
+-------+-------+ point to point connection +-------+-------+
eth0 | creates a bridge | eth0
10.0.0.100 | that plugs machine B | 192.168.0.100
port 22 | into network A |
forwarded | |
here | |
+-------+-------+ +-~-~-~-~-~-~-~-+ +-------+-------+
| Network A | | | | Network B |
| 10.0.0.1/24 | 1.2.3.4 | The Internet | | 192.168.0.1/24|
| Has internet |<-------->| |<----->| Has internet |
| NAT gateway | Routable | | | NAT gateway |
+---------------+ Address +-~-~-~-~-~-~-~-+ +---------------+
EDIT
An alternative is to use a proxy for port forwarding
This will open an local SOCKS proxy :
ssh -TND 127.0.0.1:1080 localuser@localhost
This open a shell on the remote host and a tunnel to your proxy (unfortunately the -D cannot be set remotly)
ssh -R 127.0.0.1:1080:127.0.0.1:1080 remoteuser@remotehost
That will works with firefox and gnome; if your application is not socks aware wrap it with tsocks
$ sudo -s
# cat >/etc/tsocks.conf <<eof
server = 127.0.0.1
server_type = 5
server_port = 1080
eof
# tsocks apt-get update
-
To me, this seems like overkill to simply get internet. However it does have the advantage of not needing to install anything on the client side.– LawrenceFeb 12, 2014 at 1:27
-
@Lawrence the question was to get Internet, Internet is connecting networks with IP. But if you prefer a port forwarding solution I will add that alternative (without additional software too)– EmmanuelFeb 12, 2014 at 14:45
-
From the way the question was phrased, I was under the impression that the only thing that's needed is web access. Of course I could be wrong and your answer could well be the correct one in this situation.– LawrenceFeb 12, 2014 at 15:20
You could install a http proxy (like squid) on the client that is accessing this server, and then tunnel traffic back through the ssh connection to the client and then through the proxy.
Something like this
+----------+ +-----------+
| |+----SSH+-->| |
| Client | | Server |
|+--------+| | |
Internet <-++-+PROXY<++<SSH Tunnel--+ |
|+--------+| | |
+----------+ +-----------+
Sshing to the server would go something like this
ssh -R 3128:127.0.0.1:3128 user@server
Then on the server, you would setup apt to use a proxy with the address and port of 127.0.0.1:3128
Adding the following line into /etc/apt/apt.conf
should do the trick
Acquire::http::Proxy "http://127.0.0.1:3128";
-
Seems like the wrong tunnel option to ssh: -L would forward the client port to the server, which is the opposite operation. -R would forward the server port to the client. Feb 21, 2014 at 6:33
-
Option -L
opens the local port (on the server) 3128 toremoteserver:remote port
. In this case, the remote server is the client machine itself, hence127.0.0.1
.Option -R
Opens the port on the remote server (in this case the client) and allows connects back to the server on a certain port.– LawrenceFeb 21, 2014 at 13:34 -
Sounds like we agree on the directionality, but your description seems ambiguous: -L allows the client to do a local open, and that open call is forwarded to the server. That's the opposite of what your drawing suggests: the server needs to open a port on the client, thus the need for -R. (Source: I do this all the time on a daily basis... :) Feb 21, 2014 at 18:41
-
You could install squid on your machine and then:
sudo apt-get install squid
sudo /etc/init.d/squid restart
ssh -L3128:127.0.0.1:3128 host
And once inside:
export http_proxy=http://127.0.0.1:3128/
export https_proxy=http://127.0.0.1:3128/
export ftp_proxy=http://127.0.0.1:3128/ (not Sure)
and try: apt-get update
It should work.
Maybe you can install a proxy on the server to access internet and modify apt to connect using http proxy, adding entries in /etc/apt/apt.conf
Acquire::http::Proxy "http : //user:password@ServerIP:Port";
I'm telling this because is the way I am getting all the updates in my company. Here we have configured squid as http proxy.
Best of luck!
-
I've updated my question. It isn't only about downloading software (which I first said) but it is about connection to the Internet. Feb 11, 2014 at 8:31
-
You can configure your default gateway to route the traffic using the VPN address as GW and in the server create a rule to redirect the traffic from your pc to the address. I don't have enough rep to add multiple references, but I searched in google for "redirect traffic iptables" and for "set default gateway linux" and there are two good articles. Sorry I can not link my rep is too low :(. Maybe you have to take care of destination and source natting. Feb 11, 2014 at 8:40