1

A Raspberry Pi is located behind a hardware firewall which is configured to block all outgoing communication to any IP except my server (all ports are allowed) and to block all incoming communication except the response requested by the Pi (obviously from my server). I can access the Pi from my server by tunneling within a SSH connection initiated by the Pi to my server. The firewall cannot be reconfigured.

RaspPi ---F/W---> MyServer <---Internet---> Repositories

How can I update the Pi as it cannot communicate directly to the repository URLs?

sudo apt-get -y update
  • 1
    Install an HTTP proxy (listening on localhost only, to avoid exposure) on the bastion host and configure the Pi to use this proxy server? – Celada Jun 12 '17 at 21:45
  • You could allow MyServer to be a repository mirror. – KevinO Jun 12 '17 at 21:47
  • @Celada I just found stackoverflow.com/questions/36353955/…. Maybe? – user1032531 Jun 12 '17 at 21:47
  • @KevinO How does a repository mirror work? – user1032531 Jun 12 '17 at 21:48
  • Essentially MyServer would obtain the various repo packages, and then provide them. We run a mirror so that our local network machines accesses packages directly rather than every machine running out and downloading the same file from the internet. It might be overkill (the proxy approach might work better for a single machine). This link discusses a local mirror, but I have no direct apt-get experience (we're a RHEL shop). – KevinO Jun 12 '17 at 21:52
2

2 and a half solutions - Do a ssh tunnel or set up a mirror or rather proxy connections to the mirror for the pi

Use a ssh tunnel.

From the pi, start a screen session or something and connect to your remote server via ssh with some arguments

ssh -L8000:hostname.of.apt.repo:80 user@remotebox

Then point your /etc/apt/sources.list entries to something like http://localhost:8000/raspbian - mine looks like

deb http://archive.raspbian.org/raspbian wheezy main contrib non-free

so I'd change it to

deb http://localhost:8000/raspbian wheezy main contrib non-free

And my ssh command would be

ssh -L8000:archive.raspbian.org:80 user@remotebox

Then run your normal apt-get update && apt-get dist-upgrade or whatever you want to do

Turn your box into the repository

Well, you probably don't want to mirror gigs of files for just one machine, so consider setting up a proxy (with authentication) and setting it to be used in your apt.conf file on the pi.

  • For option 1, is /etc/apt/sources.list (deb http://mirrordirector.raspbian.org/raspbian/ jessie main contrib non-free rpi) or /etc/apt/sources.list.d/raspi.list the source list. (deb http://archive.raspberrypi.org/debian/ jessie main ui)? EDIT. By your answer, I take it it is the later. – user1032531 Jun 12 '17 at 22:08
  • For option 2, there isn't an apt.conf file. Also, for the proxy, will squid be acceptable? – user1032531 Jun 12 '17 at 22:13
  • Edited to clarify the /etc/apt/sources.list - but be aware that apt will bring in /etc/apt/sources.list.d/*.list as well. If you'd rather go the proxy route, here's an answer on configuring a pi to use a proxy for apt - stackoverflow.com/questions/25322280/… The apt.conf reference was from a debian wiki – ivanivan Jun 12 '17 at 22:17
  • And yes, squid would be a fine proxy to use. – ivanivan Jun 12 '17 at 22:18
  • The proxy was perfect. Had to hardcode the IP as evidently google's nameservers are not accessible. Thanks! – user1032531 Jun 13 '17 at 0:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.