1

I wanted to opens a web page via socks proxy. my scenario is I have two jump servers. 1 Jump server to get connected and second jump server to access the webpages.

ssh [email protected] -D 10100 -tt ssh [email protected] -D 10101

I also tried this.

ssh [email protected] -D 10100

then on the second jump server

[email protected] -D 10101

In both the cases I still cannot access my webpage who have direct readability from second jump server which is 192.168.2.2

so how can I open the webpage from my localhost.

Improve this question
4
  • are you forced to use -tt at all? I just hope 192.168.1.2 has not a configuration preventing you to forward ports at all. My answer expect 192.168.1.2 not restricting tunnels, and would be better without requiring using a tty.
    – A.B
    Commented Nov 16, 2019 at 13:42
  • If I don't use -tt I am getting an error Pseudo-terminal will not be allocated because stdin is not a terminal. Permission denied, please try again. Permission denied, please try again.
    – Hulk711
    Commented Nov 17, 2019 at 1:18
  • Ok I didn't realize chaining ssh when typing passwords requires -tt (because as shown in my answer I never do this). No problem
    – A.B
    Commented Nov 17, 2019 at 1:52
  • I think, its because I dont have root/sudo access on the jump servers.
    – Hulk711
    Commented Nov 18, 2019 at 0:35

1 Answer 1

Reset to default
0

In your current configuration, you'd be attempting to stack SOCKS5 over SOCKS5 which would be very difficult to use.

Since 192.168.2.2 will be able to reach and resolve correctly the webserver, that's the one which should keep the DynamicForward (-D) option. You can use a classic LocalForward (-L) to reach it.

This should work, but wouldn't be the best with regard to security: a 3rd party having access to 192.168.1.2 could then use your SOCKS5 entry point too. Don't use it:

ssh -tt -L 10100:localhost:10101 [email protected] ssh -D 10101 [email protected]

Since there's no need to leave the DynamicForward tunnel entry point on 192.168.1.2, better have the LocalForward tunnel be used to reach the 2nd host's ssh port, from the initial client. This will allow the intended DynamicForward configuration to be moved to the local client.

term1:

ssh -L 2222:192.168.2.2:22 [email protected]

term2 (still on the initial client):

ssh -D 10100 -p 2222 user1@localhost

Actually this can be simplified using ProxyJump (-J), if available. This will handle under the hood the first port forward to 192.168.2.2's ssh server, removing the need of LocalForward at all:

ssh -D 10100 -J [email protected] [email protected]
Improve this answer
3
  • I still cannot get the webpage open from my local pc 192.168.2.3:10100 gives me "Your Internet access is blocked"
    – Hulk711
    Commented Nov 17, 2019 at 1:24
  • You are asking a question about SOCKS. Your socks proxy is now at localhost:10100 , which you must configure in your web browser . In no way you then should use 192.168.2.3:10100 . Use https://192.168.2.3/ (port has to be the usual default 443).
    – A.B
    Commented Nov 17, 2019 at 1:47
  • It worked!!, thanks alot
    – Hulk711
    Commented Nov 18, 2019 at 0:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .