11

I can use my home computer A to connect by SSH to a server B where access to the external network is blocked. In other words, all requests to Internet from B throw an error: Network is unreachable. Can I redirect all these requests to pass through the computer A which has an unrestricted access to Internet?

Server B is a server which hosts one of my website. I want to download files in order to install some software. But the connection is blocked. I was able to transfer files but it was complicated because the software versions are different on A and B, so the dependencies where different and it required different files on A and B.

I searched on Internet and it seems that I need a reverse tunnel. But I only found solutions where a port is redirected. But it's not what I need since I don't want B to access to A but to Internet.

  • if the downvoter of this questions sees this comment, would you mind letting us know why? I don't see anything wrong with it, even if the answer is "not possible". – strugee Feb 21 '14 at 2:11
  • Possible duplicate of unix.stackexchange.com/questions/111972/… – Lawrence Feb 21 '14 at 2:24
  • ssh allows you to do either local or remote port forwarding -- i.e. when an application on B attempts to open a local port X, that gets forwarded to A as an attempt to open whatever port you've specified. So then A is free to forward that connection request out to the Internet. You haven't mentioned what port(s) or protocols you're trying to use, that would make construction of detailed answers easier. – Stabledog Feb 21 '14 at 6:29
  • I'm trying to use composer, so it should be HTTP and HTTPS requests to github in order to download the packages. – A.L Feb 22 '14 at 16:44
6

You can run a proxy on Computer A that computer B would then connect to in order to access the internet through Computer A.

Something like this

             +----------+            +-----------+
             |          |+----SSH+-->|           |
             |     A    |            |    B      |
             |+--------+|            |           |
  Internet <-++-+PROXY<++<SSH Tunnel--+          |
             |+--------+|            |           |
             +----------+            +-----------+

Install a proxy like squid on A which listens on port 3128, and then you can ssh to the server with this -
ssh -L 3128:127.0.0.1:3128 user@B

That will allow B to access the internet through A

  • Once connected to B, how the requests to Internet will be redirected to A? There's no configuration to change? – A.L Apr 18 '14 at 21:30
  • You'll need to set a proxy server on B to 127.0.0.1:3128 – Lawrence Apr 22 '14 at 3:28
4

@Lawrence 's answer was good enough for me to get it all down. But here are the more detailed steps I used.

I used this for using my laptops 4g dongle to route internet to a raspberry pi with a fixed line connection to a wifi router.

If your host is a mac: install squidman http://squidman.net/squidman/

(not just generic squid, I had too much trouble with building it) The default settings seemed good enough for me.

connect to 4g connect to wifi - configure a static ip on your wifi and remove the gateway address (unless you are doing advanced things) else you get two default routes and its very annoying. - make sure your wifi router is not using the same 192.168.x.y range (configure a different "x" in this case)

ssh -R 8080:localhost:8080 pi@<ip address of the pi or target machine>

On the PI

export http_proxy=http://localhost:8080

with visudo add the text:

Defaults env_keep = "http_proxy https_proxy ftp_proxy"

Now wget will work and so will sudo apt-get so you can install packages.

If you want git as well its here: https://stackoverflow.com/questions/128035/how-do-i-pull-from-a-git-repository-through-an-http-proxy

  • Thanks for your answer. What is the role of visudo here? Where do you add the text? (I can't use sudo on my Web hosting) – A.L Sep 14 '15 at 16:56
  • I dont really understand your question, but if you just type visudo into terminal (you might need a 'sudo visudo') you can add the line of text to the bottom. – SpiRail Mar 18 '16 at 15:38
  • there's no root access on my Web hosting. – A.L Mar 18 '16 at 16:34
  • It was a long time ago now. But from memory visudo edits the sudoers file and the line being added means that those user environment variables are kept when typing sudo. If you cant do sudo, then you don't need this step anyway. – SpiRail Jun 13 '16 at 9:59
3

Just adding some more and clear steps to @Lawrence and @SpiRail's answers.

Do the setup as follows:

Setup on Host A:

  1. Install proxy server Squid on Host A . By default Squid listens on port 3128.
    yum install squid
  2. Comment the http_access deny all then add http_access allow all in /etc/squid/squid.conf
  3. If Host A itself uses some proxy say 10.140.78.130:8080 to connect to internet then also add that proxy to /etc/squid/squid.conf as follows:
refresh_pattern (Release|Packages(.gz)*)$ 0 20% 2880
cache_peer 10.140.78.130 parent 8080 0 no-query default
never_direct allow all

Setup on Host B:

  1. Add the following entries to /etc/environment
export http_proxy=http://127.0.0.1:3129
export https_proxy=http://127.0.0.1:3129
  1. source /etc/environment

Now our setup is complete.

Creating SSH tunnel with Remote port forwarding

  1. Run the following SSH command from Host A
    ssh -R 3129:localhost:3128 user@HostB

    If you want to make persistent SSH tunnel, you can use autossh as follows:
    autossh -M 20000 -f -NT -R 3129:localhost:3128 user@HostB
    For above autossh command to work, you should be having SSH Keys setup from HostA to HostB

  2. This will allow Host B to access the internet through Host A.

Checking the internet:

  1. Run the following command from Host B
    wget https://google.com

Traffic flow diagram : enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.