A Raspberry Pi is located behind a hardware firewall which is configured to block all outgoing communication to any IP except my server (all ports are allowed) and to block all incoming communication except the response requested by the Pi (obviously from my server). I can access the Pi from my server by tunneling within a SSH connection initiated by the Pi to my server. The firewall cannot be reconfigured.

RaspPi ---F/W---> MyServer <---Internet---> Repositories

How can I update the Pi as it cannot communicate directly to the repository URLs?

sudo apt-get -y update
  • 1
    Install an HTTP proxy (listening on localhost only, to avoid exposure) on the bastion host and configure the Pi to use this proxy server?
    – Celada
    Jun 12, 2017 at 21:45
  • You could allow MyServer to be a repository mirror.
    – KevinO
    Jun 12, 2017 at 21:47
  • @Celada I just found stackoverflow.com/questions/36353955/…. Maybe? Jun 12, 2017 at 21:47
  • @KevinO How does a repository mirror work? Jun 12, 2017 at 21:48
  • Essentially MyServer would obtain the various repo packages, and then provide them. We run a mirror so that our local network machines accesses packages directly rather than every machine running out and downloading the same file from the internet. It might be overkill (the proxy approach might work better for a single machine). This link discusses a local mirror, but I have no direct apt-get experience (we're a RHEL shop).
    – KevinO
    Jun 12, 2017 at 21:52

1 Answer 1


2 and a half solutions - Do a ssh tunnel or set up a mirror or rather proxy connections to the mirror for the pi

Use a ssh tunnel.

From the pi, start a screen session or something and connect to your remote server via ssh with some arguments

ssh -L8000:hostname.of.apt.repo:80 user@remotebox

Then point your /etc/apt/sources.list entries to something like http://localhost:8000/raspbian - mine looks like

deb http://archive.raspbian.org/raspbian wheezy main contrib non-free

so I'd change it to

deb http://localhost:8000/raspbian wheezy main contrib non-free

And my ssh command would be

ssh -L8000:archive.raspbian.org:80 user@remotebox

Then run your normal apt-get update && apt-get dist-upgrade or whatever you want to do

Turn your box into the repository

Well, you probably don't want to mirror gigs of files for just one machine, so consider setting up a proxy (with authentication) and setting it to be used in your apt.conf file on the pi.

  • For option 1, is /etc/apt/sources.list (deb http://mirrordirector.raspbian.org/raspbian/ jessie main contrib non-free rpi) or /etc/apt/sources.list.d/raspi.list the source list. (deb http://archive.raspberrypi.org/debian/ jessie main ui)? EDIT. By your answer, I take it it is the later. Jun 12, 2017 at 22:08
  • For option 2, there isn't an apt.conf file. Also, for the proxy, will squid be acceptable? Jun 12, 2017 at 22:13
  • Edited to clarify the /etc/apt/sources.list - but be aware that apt will bring in /etc/apt/sources.list.d/*.list as well. If you'd rather go the proxy route, here's an answer on configuring a pi to use a proxy for apt - stackoverflow.com/questions/25322280/… The apt.conf reference was from a debian wiki
    – ivanivan
    Jun 12, 2017 at 22:17
  • And yes, squid would be a fine proxy to use.
    – ivanivan
    Jun 12, 2017 at 22:18
  • The proxy was perfect. Had to hardcode the IP as evidently google's nameservers are not accessible. Thanks! Jun 13, 2017 at 0:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.