This is slightly different than the other SSH questions I have seen on here so here it goes. I have a complex setup for accessing a web application and unfortunately there is no way around it. Here is the scenario and systems involved (IP addresses anonymized for obvious reasons):

System Alpha
System Bravo
System Charlie
System Delta

I need to communicate to a website available to System Delta from System Alpha. The problem is, I cannot talk to System Delta directly. Currently, I can SSH in to System Bravo, and I can SSH into System Charlie utilizing a proxy command which utilizes System Bravo as the proxy. To illustrate this, here is my SSH Config:

Host system.bravo
  User bob
  ForwardAgent yes

Host system.charlie
  User bob
  ForwardAgent yes
  ProxyCommand ssh -q system.bravo nc localhost 1081

System Charlie is accessible to System Alpha in this way because it has created a reverse SSH tunnel to System Bravo on port 1081. This is done because the firewall sitting between System Bravo and System Charlie ONLY allows SSH outbound to System Bravo. I know this is annoying, but it is a client requirement.

System Charlie can SSH into System Delta without issue. My problem is, how do I go about setting up a usable SOCKS proxy with SSH so that System Alpha can access a website only accessible from System Delta. Normally I would do it like this:

ssh -2 -C -D 4001 -L 4002:localhost:4002 -L 4003:localhost:4003 [email protected]
ssh -2 -C -D 4002 -L 4003:localhost:4003 [email protected]
ssh -2 -C -D 4003 [email protected]

Then I would simply point Firefox to localhost:4003 and that would be my working proxy to access the website. However, because of the weird setup between System Bravo and System Charlie this will not work. ***It was pointed out to me a diagram displaying communications would make this easier. So here it is:

A full list of possible connections:
     ----->      --X-->       ----->
Alpha       Bravo      Charlie      Delta
     <--X--      <-----       <--X--

The connection between Alpha and Bravo and Charlie as it is currently 

     ProxyCommand ssh -q system.bravo nc localhost 1081
Alpha    Bravo <---------------------------------------- Charlie
                      AUTOSSH -R 1081:localhost:22 

-----> = An allowed connection via SSH
--X--> = A blocked connection, only reverse SSH possible

Does anyone have a solution on how I can accomplish this keeping in mind the required proxy command and reverse SSH tunnel between System Bravo and System Charlie?

Thanks so much

PS: I hope my diagram helps, sorry that it is not a real image

  • I guess that your four systems are running some form of Unix and/or Linux, simply based on the fact that you posted in the Unix & Linux community.   I guess that’s OK, but, since this question is not really about Unix, it might get a better response in Super User (or maybe even Server Fault).  Please do not just re-ask the question in one of those communities.  I suggest that you wait a day or two, and, if you aren’t getting any help here, click on “flag” below your question and ask a moderator to move your question. Sep 13, 2017 at 19:42
  • I think your blocker is the ssh tunnel outbound from Charlie to Bravo. What I mean is, the problem may be with how that tunnel is established, what options and features are en/dis -abled. Is this a constant connection that the client leaves up? I've never seen a chain of jumphost tunneling like this so I wouldn't know how to start, but if the port forwarding isn't correct with that Charlie => Bravo tunnel it all ends there. Sidenote Could you run a firefox/iceweasel process from Charlie or Delta and push the X session back over SSH to your local system?
    – 0xSheepdog
    Sep 13, 2017 at 21:02
  • Does this need to be ssh tunnel or would you consider using a Point-To-Point vpn like tincd? It is very powerful replacement for engineering complex ssh tunnels like this. Secret sharing is the same as with SSH, nodes need to know direct neighbor public key, but are routable to outside nodes if you let it. In principle you could use vpn to setup the link for ssh port only and still use SOCKS for the actual webserver proxy.
    – crasic
    Sep 13, 2017 at 21:07
  • I would love to utilize something like tincd but could only do so if it appeared to be SSH. The firewall between the connections is 'next-gen' (as in it is an IDS/IPS all in one) and so it will block the connection if it detects anything other than the SSH protocol
    – NetSec
    Sep 13, 2017 at 21:13

1 Answer 1


Seems like if you can (from A) ssh to C, you can do:

user@Alpha:~$ ssh -L1234:localhost:1234 Charlie
user@Charlie:~$ ssh -Dlocalhost:1234 Delta

... and at that point, you can have Firefox use localhost:1234 as a SOCKS proxy. The local SSH will proxy that over the tunnel to C, where that ssh is listening as a SOCKS server and will forward it to D.

But really, I'd push back on your client: if they expect you to access sites from A, they ought to provide a sane method to do so. Like a VPN, for example.

  • Agreed, I SHOULD be able to push back on the client but it is one of those classic cases of the client being a HUGE pain. Unfortunately for whatever reason (Im sure its a good one) your recommendation does not work. I should have specified that I had tried that before, but something to do with the Charlie to Bravo connection prevents it from working properly.
    – NetSec
    Sep 13, 2017 at 21:15
  • 1
    @NetSec Does port forwarding not work at all on Charlie? It's possible to turn it off in sshd, which its possible the client did. PS: Your question would really benefit from a diagram...
    – derobert
    Sep 13, 2017 at 21:16
  • I added a diagram, hope it helps
    – NetSec
    Sep 14, 2017 at 3:05
  • The issue was completely on the client side. They had modified one of the endpoints without telling me, so although my connection attempts (which were the same ones you suggested @derobert) SHOULD have worked, they had shutoff Delta without telling me, spun up a NEW Delta server (same name even), added my key to it so everything SEEMED to work, but the website was not available to it... Normally I could have troubleshot this using curl or something similar but their firewall rules are so restrictive I cant access anything except the single internal web application they give me access to.
    – NetSec
    Sep 14, 2017 at 3:14
  • I will mark you solution as correct because it should have worked assuming the client didn't modify anything.
    – NetSec
    Sep 14, 2017 at 3:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .