3

I was going through this post and couldn't quiet follow what is being implied there.

A great "feature" I use every day at work: The ability to have SSH listen on port 443 so I can create a tunnel which bypasses my work firewall, allowing me to run a local SOCKS proxy tunneled through SSH to my internet facing Linux server.

I can completely ignore my corporate firewall.

From what I understood, port 22 is blocked for SSH access in the office machine. How will I be connecting to the remote office machine from my home machine?

From my home machine, will I be using the command as something like,

ssh -D 1337 -f -C -q -N user@office -p 443

And then change the proxy settings in my home machine's firefox to access the office network from my home machine?

3

That's about it, but you've inverted home and office. The point is that the office firewall rejects outgoing connections other than web traffic. But since HTTPS traffic and SSH traffic are both encrypted, it can't easily distinguish between them, so the firewall just blocks outgoing connections to ports other than 443 (the standard HTTPS port) and probably has an HTTP proxy that only allows HTTP traffic on port 80 and possibly other ports.

So the idea is to run an SSH server at home, listening on port 443, and have it relay the data to anywhere. SOCKS is a generic protocol to relay TCP connections. It can relay web traffic, SSH connections, and many other protocols.

You would configure your web browser to use a SOCKS proxy, not an HTTP proxy. Major web browsers support SOCKS. If you want to use an application that doesn't support SOCKS proxying, you can run it under tsocks.

It's actually possible to distinguish SSH from HTTPS, because the first few bytes (before the traffic can be encrypted, while the two endpoints are still negociating the options and the session key) are distinguishable. Not all corporate firewalls do that. You can use stunnel to embed the SSH session in HTTPS.

  • thanks. So, I should rephrase my ssh command in the question as user@home and run the ssh command from the office machine. Am I correct in my understanding? – Ramesh Nov 7 '14 at 2:59
  • @Ramesh Yes, that's it. – Gilles 'SO- stop being evil' Nov 7 '14 at 3:00
1

I am not entirely clear on what the post talks about but I have been using something similar to redirect the http traffic over ssh from a remote server which does not support X forwarding. I do it as follows:

ssh -L23000:localhost:23000 user@remotehost
[remotehost] $ python -m SimpleHTTPServer 23000

Open browser on localhost and point it to http://localhost:23000 to browse the files on remote host in the browser. This is an example, but we have a web-based portal that we need to run on remote nodes and do stuff which we do this way.

I suppose the post talks about redirecting all the traffic from the SOCKS proxy over ssh and thus be able to access a firewalled network.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.