1

I wanted to opens a web page via socks proxy. my scenario is I have two jump servers. 1 Jump server to get connected and second jump server to access the webpages.

ssh user@192.168.1.2 -D 10100 -tt ssh user1@192.168.2.2 -D 10101

I also tried this.

ssh user@192.168.1.2 -D 10100

then on the second jump server

user1@192.168.2.2 -D 10101

In both the cases I still cannot access my webpage who have direct readability from second jump server which is 192.168.2.2

so how can I open the webpage from my localhost.

  • are you forced to use -tt at all? I just hope 192.168.1.2 has not a configuration preventing you to forward ports at all. My answer expect 192.168.1.2 not restricting tunnels, and would be better without requiring using a tty. – A.B Nov 16 '19 at 13:42
  • If I don't use -tt I am getting an error Pseudo-terminal will not be allocated because stdin is not a terminal. Permission denied, please try again. Permission denied, please try again. – Hulk711 Nov 17 '19 at 1:18
  • Ok I didn't realize chaining ssh when typing passwords requires -tt (because as shown in my answer I never do this). No problem – A.B Nov 17 '19 at 1:52
  • I think, its because I dont have root/sudo access on the jump servers. – Hulk711 Nov 18 '19 at 0:35
0

In your current configuration, you'd be attempting to stack SOCKS5 over SOCKS5 which would be very difficult to use.

Since 192.168.2.2 will be able to reach and resolve correctly the webserver, that's the one which should keep the DynamicForward (-D) option. You can use a classic LocalForward (-L) to reach it.

This should work, but wouldn't be the best with regard to security: a 3rd party having access to 192.168.1.2 could then use your SOCKS5 entry point too. Don't use it:

ssh -tt -L 10100:localhost:10101 user@192.168.1.2 ssh -D 10101 user1@192.168.2.2

Since there's no need to leave the DynamicForward tunnel entry point on 192.168.1.2, better have the LocalForward tunnel be used to reach the 2nd host's ssh port, from the initial client. This will allow the intended DynamicForward configuration to be moved to the local client.

term1:

ssh -L 2222:192.168.2.2:22 user@192.168.1.2

term2 (still on the initial client):

ssh -D 10100 -p 2222 user1@localhost

Actually this can be simplified using ProxyJump (-J), if available. This will handle under the hood the first port forward to 192.168.2.2's ssh server, removing the need of LocalForward at all:

ssh -D 10100 -J user@192.168.1.2 user1@192.168.2.2
| improve this answer | |
  • I still cannot get the webpage open from my local pc 192.168.2.3:10100 gives me "Your Internet access is blocked" – Hulk711 Nov 17 '19 at 1:24
  • You are asking a question about SOCKS. Your socks proxy is now at localhost:10100 , which you must configure in your web browser . In no way you then should use 192.168.2.3:10100 . Use https://192.168.2.3/ (port has to be the usual default 443). – A.B Nov 17 '19 at 1:47
  • It worked!!, thanks alot – Hulk711 Nov 18 '19 at 0:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.