39

I can use my home computer A to connect by SSH to a server B where access to the external network is blocked. In other words, all requests to Internet from B throw an error: Network is unreachable. Can I redirect all these requests to pass through the computer A which has an unrestricted access to Internet?

Server B is a server which hosts one of my website. I want to download files in order to install some software. But the connection is blocked. I was able to transfer files but it was complicated because the software versions are different on A and B, so the dependencies where different and it required different files on A and B.

I searched on Internet and it seems that I need a reverse tunnel. But I only found solutions where a port is redirected. But it's not what I need since I don't want B to access to A but to Internet.

4
  • if the downvoter of this questions sees this comment, would you mind letting us know why? I don't see anything wrong with it, even if the answer is "not possible".
    – strugee
    Feb 21, 2014 at 2:11
  • Possible duplicate of unix.stackexchange.com/questions/111972/…
    – Lawrence
    Feb 21, 2014 at 2:24
  • ssh allows you to do either local or remote port forwarding -- i.e. when an application on B attempts to open a local port X, that gets forwarded to A as an attempt to open whatever port you've specified. So then A is free to forward that connection request out to the Internet. You haven't mentioned what port(s) or protocols you're trying to use, that would make construction of detailed answers easier.
    – Stabledog
    Feb 21, 2014 at 6:29
  • I'm trying to use composer, so it should be HTTP and HTTPS requests to github in order to download the packages.
    – A.L
    Feb 22, 2014 at 16:44

3 Answers 3

37

Just adding some more and clear steps to @Lawrence and @SpiRail's answers.

Do the setup as follows:

Setup on Host A:

  1. Install proxy server Squid on Host A . By default Squid listens on port 3128.
    yum install squid
  2. Comment the http_access deny all then add http_access allow all in /etc/squid/squid.conf
  3. If Host A itself uses some proxy say 10.140.78.130:8080 to connect to internet then also add that proxy to /etc/squid/squid.conf as follows:
refresh_pattern (Release|Packages(.gz)*)$ 0 20% 2880
cache_peer 10.140.78.130 parent 8080 0 no-query default
never_direct allow all

Setup on Host B:

  1. Add the following entries to /etc/environment
export http_proxy=http://127.0.0.1:3129
export https_proxy=http://127.0.0.1:3129
  1. source /etc/environment

Now our setup is complete.

Creating SSH tunnel with Remote port forwarding

  1. Make sure the server is started on Host A (e.g. sudo service squid start).

  2. Run the following SSH command from Host A
    ssh -R 3129:localhost:3128 user@HostB

    If you want to make persistent SSH tunnel, you can use autossh as follows:
    autossh -M 20000 -f -NT -R 3129:localhost:3128 user@HostB
    For above autossh command to work, you should be having SSH Keys setup from HostA to HostB

  3. This will allow Host B to access the internet through Host A.

Checking the internet:

  1. Run the following command from Host B
    wget https://google.com

Traffic flow diagram : enter image description here

1
  • This is working great for accessing regular websites. However if I try to run sudo apt-get update I hit "The following signatures couldn't be verified because the public key is not available: NO_PUBKEY {the key}". From googling it seems to be caused by a DNS issue. If I try an add the key I get "gpg: keyserver receive failed: No keyserver available". Do you have any advice?
    – Shardj
    Apr 27 at 12:32
17

You can run a proxy on Computer A that computer B would then connect to in order to access the internet through Computer A.

Something like this

             +----------+            +-----------+
             |          |+----SSH+-->|           |
             |     A    |            |    B      |
             |+--------+|            |           |
  Internet <-++-+PROXY<++<SSH Tunnel--+          |
             |+--------+|            |           |
             +----------+            +-----------+

Install a proxy like squid on A which listens on port 3128, and then you can ssh to the server with this -
ssh -L 3128:127.0.0.1:3128 user@B

That will allow B to access the internet through A

3
  • Once connected to B, how the requests to Internet will be redirected to A? There's no configuration to change?
    – A.L
    Apr 18, 2014 at 21:30
  • You'll need to set a proxy server on B to 127.0.0.1:3128
    – Lawrence
    Apr 22, 2014 at 3:28
  • Shouldn't it be "-R" instead of "-L"?
    – Y. Zhai
    Apr 24, 2021 at 7:58
7

@Lawrence 's answer was good enough for me to get it all down. But here are the more detailed steps I used.

I used this for using my laptops 4g dongle to route internet to a raspberry pi with a fixed line connection to a wifi router.

If your host is a mac: install squidman http://squidman.net/squidman/

(not just generic squid, I had too much trouble with building it) The default settings seemed good enough for me.

connect to 4g connect to wifi - configure a static ip on your wifi and remove the gateway address (unless you are doing advanced things) else you get two default routes and its very annoying. - make sure your wifi router is not using the same 192.168.x.y range (configure a different "x" in this case)

ssh -R 8080:localhost:8080 pi@<ip address of the pi or target machine>

On the PI

export http_proxy=http://localhost:8080

with visudo add the text:

Defaults env_keep = "http_proxy https_proxy ftp_proxy"

Now wget will work and so will sudo apt-get so you can install packages.

If you want git as well its here: https://stackoverflow.com/questions/128035/how-do-i-pull-from-a-git-repository-through-an-http-proxy

4
  • Thanks for your answer. What is the role of visudo here? Where do you add the text? (I can't use sudo on my Web hosting)
    – A.L
    Sep 14, 2015 at 16:56
  • I dont really understand your question, but if you just type visudo into terminal (you might need a 'sudo visudo') you can add the line of text to the bottom.
    – SpiRail
    Mar 18, 2016 at 15:38
  • there's no root access on my Web hosting.
    – A.L
    Mar 18, 2016 at 16:34
  • It was a long time ago now. But from memory visudo edits the sudoers file and the line being added means that those user environment variables are kept when typing sudo. If you cant do sudo, then you don't need this step anyway.
    – SpiRail
    Jun 13, 2016 at 9:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.