I've just used this guide to create a SSH tunnel to bypass my corporate proxy. I didn't use the usual "Putty", but in "MobaXterm" (a program similar to putty that also offers unix tools) I wrote, to create the tunnel:

ssh -D 7070 -p 22 user@yourserver.com sleep 9999

Then I went to my browser (Firefox) and I told it to use SOCKS on the localhost port 7070.

All is good and it's working, but I have no clue on how the underling technology actually works. I mean, on a general level I know how the process works, but I would like to go a little deeper than that.

What I mean is, currently we can compare my knowledge to the one I have of cars: I know there is an engine, 4 wheels, etc, but I have no clue how the engine actually uses gasoline to move the car. The 2 answers I received so far only explain to me what I already know. I have a CCNP, work in a datacenter as network engineer, know how to program, know fair enough of the Linux environment. What I would like to have from you is a thorough (but less than a 20-pages-long-RFC) answer.

The answer should include:

  1. A description of the main options tunnel-wise. A good example is the image in this answer: Understanding SSH tunnels
  2. Which type of tunnel is used when and for what (normal tunnels, reverse tunnels)
  3. A wireshark capture of the before/after the tunnel
  4. An image explaining the process (I am a visual guy after all)

I promise that I will give 100 points as soon as I can put a bounty on the question. I really need a good answer on this. (In case I forget about the bounty, please email me: ilcon7e[at]gmail[dot]com


Improved the question.

  • search google for ssh tunneling and select images? – Anthon Jul 24 '14 at 14:19
  • @Anthon already did, but images without words are quite difficult to read. For example, gorgeous picture can be found in this answer: unix.stackexchange.com/questions/52234/… but they are quite unclear to me... :( – Con7e Jul 24 '14 at 14:23
  • [in response to your comment on my answer] I'm unable to figure out what you're asking us to explain. How SSH works on a low-level technical level is explained in RFC 4254 and several related RFCs. But that's really on the "I need to implement my own SSH program" level. Could you maybe elaborate on which part of SSH tunneling is perplexing you, and what level of background knowledge we can assume in our answers? – derobert Jul 24 '14 at 19:26
  • ... or come and join the chat room at chat.stackexchange.com/rooms/26/unix-and-linux and see if we can't figure out exactly what question you're trying to ask. – derobert Jul 24 '14 at 19:29
  • I changed my question. Hope is more clear. – Con7e Jul 24 '14 at 19:33

When you visit a website (one that's not hindered by your corporate firewall) your browser sends a request to the server listed in the URL on port 80 (by default). For example, to visit this site our browsers communicate with port 80 of the server unix.stackexchange.com

When you set your proxy settings you told your browser to send everything to localhost port 7070 regardless of the URL. A proxy server is designed to simply fetch data on behalf of a client. There are various proxy servers available (a quick search of your disto's repository will bring up a few - squid is one and the apache and nginx webservers can also act as proxies) but installing one wouldn't help your scenario as the proxy would try to access the website on your behalf and still be blocked by your corporate firewall.

However, ssh with the -D option in conjunction with the sshd daemon on the remote site (yourserver.com) acts like a proxy server, except that this one is split into two halves - a local ssh and a remote sshd.

The request from your browser for http://unix.stackexchange.com is sent to the ssh client on your computer which is listening on port 7070. This encrypts the request and sends it to the remote sshd server. This decrypts the request and places sends it on to the relevant server (again unix.stackexchange.com, port 80) with the return path (the IP address and port to which the server should return it's response) modified to be that of the sshd server (yourserver.com).

The Stack Exchange webserver knows nothing of this proxying and replies with whichever page you requested to the IP address and port of the sshd server (due to that small modification). However, this server is aware that the request originated from ssh running on your computer (it maintains a table of this type of information) therefore it encrypts it and sends it back to you. ssh on your computer sends the reponse back to your browser which dutifully displays your webpage for you.

ssh is acting like a distributed proxy. The 'tunneling' here is the fact that the proxy is in two halves and they talk to each other through an encrypted tunnel that nobody can snoop and (in your case) is using a port that isn't blocked by your firewall (port 22).


Very high level overview:

  1. The -D option tells ssh to listen for connections on that port using the SOCKS protocol. You configure Firefox to connect to ssh and speak the SOCKS protocol.

  2. You type http://www.google.com into your browser.

  3. Firefox connects to that SOCKS port. SOCKS can do a bunch of things, but what we're interested in is this: Firefox asks the SOCKS server (ssh) "hey, could you talk to www.google.com, and give it this HTTP request? And tell me (Firefox) what www.google.com says in response to that?" (Firefox doesn't know or really care that ssh is going to forward that request over the SSH tunnel).

  4. ssh forwards that request along the ssh connection to something running on the remote machine (probably sshd).

  5. the program running on the remote machine makes the connection, sends the data to Google, and gets a response back.

  6. the program on the remote machine, as requested, tells ssh on your machine what the response is.

  7. ssh on your machine, as requested, tells Firefox what the response is.

  8. Firefox knows its a web page, so it starts working on displaying it.

  9. Repeat many times, for all the images, JavaScript, CSS, etc.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.