I've a remote server which is not connected to the internet, but I can connect from via SSH to it through a VPN tunnel. On this client I got internet. Is it possible 'get internet' from the client through the VPN conection? The server is a Debian 7 machine.

4 Answers 4


f your server is running a recent sshd version ( >= 4.3 ) you should be able to use the ssh IP tunneling option "-w" and set up a point-to-point connection. After that it is just a matter of routing.
(As your server is only reachable through the network beware to not cut the link when setting the routes. For instance open a new ssh connection to your server from another server connected to the same lan. Local routes are unaffected so you will not risk to cut the connection even if you remove the default gateway.)

see doccumentation here

extract :

    +---------------+            OpenSSH 4.3           +---------------+
    |   Machine A   | tun0 -- Tunnel Interface -- tun0 |   Machine B   |
    |  Has a tunnel | <------------------------------->|  Has a tunnel |  
    |  and ethernet |   |  and ethernet |
    +-------+-------+     point to point connection    +-------+-------+
       eth0 |                 creates a bridge                 | eth0 |               that plugs machine B               |
   port 22  |                  into network A                  |          
  forwarded |                                                  |
    here    |                                                  |
    +-------+-------+          +-~-~-~-~-~-~-~-+       +-------+-------+ 
    |   Network A   |          |               |       |   Network B   |
    |  |  |  The Internet |       ||
    |  Has internet |<-------->|               |<----->|  Has internet |
    |  NAT gateway  | Routable |               |       |  NAT gateway  |
    +---------------+ Address  +-~-~-~-~-~-~-~-+       +---------------+


An alternative is to use a proxy for port forwarding

This will open an local SOCKS proxy :

ssh -TND  localuser@localhost

This open a shell on the remote host and a tunnel to your proxy (unfortunately the -D cannot be set remotly)

ssh -R remoteuser@remotehost

That will works with firefox and gnome; if your application is not socks aware wrap it with tsocks

$ sudo -s 
# cat >/etc/tsocks.conf <<eof
server =
server_type = 5
server_port = 1080

# tsocks apt-get update 
  • To me, this seems like overkill to simply get internet. However it does have the advantage of not needing to install anything on the client side.
    – Lawrence
    Feb 12, 2014 at 1:27
  • @Lawrence the question was to get Internet, Internet is connecting networks with IP. But if you prefer a port forwarding solution I will add that alternative (without additional software too)
    – Emmanuel
    Feb 12, 2014 at 14:45
  • From the way the question was phrased, I was under the impression that the only thing that's needed is web access. Of course I could be wrong and your answer could well be the correct one in this situation.
    – Lawrence
    Feb 12, 2014 at 15:20

You could install a http proxy (like squid) on the client that is accessing this server, and then tunnel traffic back through the ssh connection to the client and then through the proxy.

Something like this

             +----------+            +-----------+
             |          |+----SSH+-->|           |
             |  Client  |            | Server    |
             |+--------+|            |           |
  Internet <-++-+PROXY<++<SSH Tunnel--+          |
             |+--------+|            |           |
             +----------+            +-----------+

Sshing to the server would go something like this
ssh -R 3128: user@server

Then on the server, you would setup apt to use a proxy with the address and port of

Adding the following line into /etc/apt/apt.conf should do the trick
Acquire::http::Proxy "";

  • Seems like the wrong tunnel option to ssh: -L would forward the client port to the server, which is the opposite operation. -R would forward the server port to the client.
    – Stabledog
    Feb 21, 2014 at 6:33
  • Option -L opens the local port (on the server) 3128 to remoteserver:remote port. In this case, the remote server is the client machine itself, hence Option -R Opens the port on the remote server (in this case the client) and allows connects back to the server on a certain port.
    – Lawrence
    Feb 21, 2014 at 13:34
  • Sounds like we agree on the directionality, but your description seems ambiguous: -L allows the client to do a local open, and that open call is forwarded to the server. That's the opposite of what your drawing suggests: the server needs to open a port on the client, thus the need for -R. (Source: I do this all the time on a daily basis... :)
    – Stabledog
    Feb 21, 2014 at 18:41
  • Yes, you are correct. Getting my directions mixed up.
    – Lawrence
    Feb 24, 2014 at 13:11

You could install squid on your machine and then:

sudo apt-get install squid
sudo /etc/init.d/squid restart
ssh -L3128: host

And once inside:

export http_proxy=
export https_proxy=
export ftp_proxy= (not Sure)
and try: apt-get update

It should work.


Maybe you can install a proxy on the server to access internet and modify apt to connect using http proxy, adding entries in /etc/apt/apt.conf

Acquire::http::Proxy "http : //user:password@ServerIP:Port";

I'm telling this because is the way I am getting all the updates in my company. Here we have configured squid as http proxy.

Best of luck!

  • I've updated my question. It isn't only about downloading software (which I first said) but it is about connection to the Internet.
    – OrangeTux
    Feb 11, 2014 at 8:31
  • You can configure your default gateway to route the traffic using the VPN address as GW and in the server create a rule to redirect the traffic from your pc to the address. I don't have enough rep to add multiple references, but I searched in google for "redirect traffic iptables" and for "set default gateway linux" and there are two good articles. Sorry I can not link my rep is too low :(. Maybe you have to take care of destination and source natting.
    – Jose Palma
    Feb 11, 2014 at 8:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .