51

I can use my home computer A to connect by SSH to a server B where access to the external network is blocked. In other words, all requests to Internet from B throw an error: Network is unreachable. Can I redirect all these requests to pass through the computer A which has an unrestricted access to Internet?

Server B is a server which hosts one of my website. I want to download files in order to install some software. But the connection is blocked. I was able to transfer files but it was complicated because the software versions are different on A and B, so the dependencies where different and it required different files on A and B.

I searched on Internet and it seems that I need a reverse tunnel. But I only found solutions where a port is redirected. But it's not what I need since I don't want B to access to A but to Internet.

3
  • Possible duplicate of unix.stackexchange.com/questions/111972/…
    – Lawrence
    Commented Feb 21, 2014 at 2:24
  • 1
    ssh allows you to do either local or remote port forwarding -- i.e. when an application on B attempts to open a local port X, that gets forwarded to A as an attempt to open whatever port you've specified. So then A is free to forward that connection request out to the Internet. You haven't mentioned what port(s) or protocols you're trying to use, that would make construction of detailed answers easier.
    – Stabledog
    Commented Feb 21, 2014 at 6:29
  • I'm trying to use composer, so it should be HTTP and HTTPS requests to github in order to download the packages. Commented Feb 22, 2014 at 16:44

4 Answers 4

51

Just adding some more and clear steps to @Lawrence and @SpiRail's answers.

Do the setup as follows:

Setup on Host A:

  1. Install proxy server Squid on Host A . By default Squid listens on port 3128.
    yum install squid
  2. Comment the http_access deny all then add http_access allow all in /etc/squid/squid.conf
  3. If Host A itself uses some proxy say 10.140.78.130:8080 to connect to internet then also add that proxy to /etc/squid/squid.conf as follows:
refresh_pattern (Release|Packages(.gz)*)$ 0 20% 2880
cache_peer 10.140.78.130 parent 8080 0 no-query default
never_direct allow all

Setup on Host B:

  1. Add the following entries to /etc/environment
export http_proxy=http://127.0.0.1:3129
export https_proxy=http://127.0.0.1:3129
  1. source /etc/environment

Now our setup is complete.

Creating SSH tunnel with Remote port forwarding

  1. Make sure the server is started on Host A (e.g. sudo service squid start).

  2. Run the following SSH command from Host A
    ssh -R 3129:localhost:3128 user@HostB

    If you want to make persistent SSH tunnel, you can use autossh as follows:
    autossh -M 20000 -f -NT -R 3129:localhost:3128 user@HostB
    For above autossh command to work, you should be having SSH Keys setup from HostA to HostB

  3. This will allow Host B to access the internet through Host A.

Checking the internet:

  1. Run the following command from Host B
    wget https://google.com

Traffic flow diagram : enter image description here

4
  • This is working great for accessing regular websites. However if I try to run sudo apt-get update I hit "The following signatures couldn't be verified because the public key is not available: NO_PUBKEY {the key}". From googling it seems to be caused by a DNS issue. If I try an add the key I get "gpg: keyserver receive failed: No keyserver available". Do you have any advice?
    – Shardj
    Commented Apr 27, 2022 at 12:32
  • I tested that solution is good, but must to use command: nohup ssh -NL 3129:localhost:3128 user@HostB Commented Nov 10, 2022 at 13:43
  • Your guide is good except one config: "http_access alow all" is very dangerous. See more: serverfault.com/a/1132572/198829 I recognize that my internet is very slow after start squid, A lot of hacker will attack you via squid traffic. Commented Jun 3, 2023 at 16:57
  • 1
    How to redirect Host B squid traffic through Host B? Commented Sep 30, 2023 at 20:15
22

You can run a proxy on Computer A that computer B would then connect to in order to access the internet through Computer A.

Something like this

             +----------+            +-----------+
             |          |+----SSH+-->|           |
             |     A    |            |    B      |
             |+--------+|            |           |
  Internet <-++-+PROXY<++<SSH Tunnel--+          |
             |+--------+|            |           |
             +----------+            +-----------+

Install a proxy like squid on A which listens on port 3128, and then you can ssh to the server with this -
ssh -L 3128:127.0.0.1:3128 user@B

That will allow B to access the internet through A

4
  • Once connected to B, how the requests to Internet will be redirected to A? There's no configuration to change? Commented Apr 18, 2014 at 21:30
  • You'll need to set a proxy server on B to 127.0.0.1:3128
    – Lawrence
    Commented Apr 22, 2014 at 3:28
  • 1
    Shouldn't it be "-R" instead of "-L"?
    – Y. Zhai
    Commented Apr 24, 2021 at 7:58
  • @Y.Zhai nohup ssh -NL 3129:localhost:3128 user@HostB Commented Nov 10, 2022 at 13:43
11

@Lawrence 's answer was good enough for me to get it all down. But here are the more detailed steps I used.

I used this for using my laptops 4g dongle to route internet to a raspberry pi with a fixed line connection to a wifi router.

If your host is a mac: install squidman http://squidman.net/squidman/

(not just generic squid, I had too much trouble with building it) The default settings seemed good enough for me.

connect to 4g connect to wifi - configure a static ip on your wifi and remove the gateway address (unless you are doing advanced things) else you get two default routes and its very annoying. - make sure your wifi router is not using the same 192.168.x.y range (configure a different "x" in this case)

ssh -R 8080:localhost:8080 pi@<ip address of the pi or target machine>

On the PI

export http_proxy=http://localhost:8080

with visudo add the text:

Defaults env_keep = "http_proxy https_proxy ftp_proxy"

Now wget will work and so will sudo apt-get so you can install packages.

If you want git as well its here: https://stackoverflow.com/questions/128035/how-do-i-pull-from-a-git-repository-through-an-http-proxy

4
  • Thanks for your answer. What is the role of visudo here? Where do you add the text? (I can't use sudo on my Web hosting) Commented Sep 14, 2015 at 16:56
  • I dont really understand your question, but if you just type visudo into terminal (you might need a 'sudo visudo') you can add the line of text to the bottom.
    – SpiRail
    Commented Mar 18, 2016 at 15:38
  • there's no root access on my Web hosting. Commented Mar 18, 2016 at 16:34
  • 1
    It was a long time ago now. But from memory visudo edits the sudoers file and the line being added means that those user environment variables are kept when typing sudo. If you cant do sudo, then you don't need this step anyway.
    – SpiRail
    Commented Jun 13, 2016 at 9:59
0

To do not bring other software, you may use ssh -D to run socks5 proxy locally, like:

ssh -D 8081 localhost

Note. Localhost must accept connections, so you may want to enable it first. Like:

sudo systemctl start sshd

And it is recommended (but not required thought) to setup auth by key, without password prompt.

And then just forward that port to the remote machine (let it be named host-without-internet):

ssh -R 8081:localhost:8081 host-without-internet

Viola! You may use SOCKS5 proxy to access internet. For example:

curl -x socks5://127.0.0.1:8081 https://ifconfig.co

Short variant (oneliner)

ssh -D 8081 localhost -t \
    ssh -R 8081:localhost:8081 host-without-internet \
        curl -x socks5://127.0.0.1:8081 https://ifconfig.co

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .