Articles

Doing magic with SSH port forward

Hopefully all readers on the dot11 blog will know SSH as the text console interface to servers and network equipment. Many will thing of it as an encrypted telnet alternative. But there is a lot more to SSH than that. One very handy function is port forward.

When opening a SSH connection it is possible to forward one or more TCP or UDP port from the client to the server or the other way.  If the client and server is separated by a firewall or proxy it can be very handy to reach devices or application not available  through the normal route.

In this post I will give a few very practical examples. Google “ssh port forward” to learn much more 😉

Browsing remote servers through a ssh jumphost

A very common setup for getting access to a remote network is that you are provided with an account to log in to a remote ssh server. This is fine for doing command line work, but if you need access to web application read on. We take advantage of the socks proxy function that is build in to many ssh servers. If you jumphost is a Linux box is very likely to be possible. A separate proxy do not need to be installed. Start by opening a ssh connection to the jumphost with

ssh username@jumphost -D 8080

Now TCP port 8080 on your own computer has become a socks proxy to the remote network. Cool right. To connect to a remote website configure your browser to use localhost port 8080 as socks proxy. I use my firefox as my “remote” browser since it has it own proxy configuration. Now I can browse remote in firefox and normal in my default browser. If I connect to another jumphost my firefox is now on the new remote network. Without any reconfiguration.

If you need to use DNS names a little more configuration is needed. Asuaming that DNS is configured on the jumphost you just need to have your firefox to put the DNS through the proxy using the setting “network.proxy.socks_remote_dns”. Write about:config in the addressbar and search for the setting.

SSH through the same jumphost

If you need to access a ssh CLI through a ssh jumphost, the same proxy as used web can be used for ssh. If using MAC or Linux the command is

ssh -o ProxyCommand='nc -x localhost:8080 %h %p' <hostname or IP>

To simplify this I have created a script on my laptop called pssh (proxy ssh)

ssh -o ProxyCommand='nc -x localhost:8080 %h %p' $1

Escape a (restrictive) proxy server

Sitting on a network behind a proxy server that blocks your work is a pain. Luckily again ssh port forward got you covered. This tip requires a little preparation, since you need your own ssh jump host with ssh enabled on port 443. If you jumphost is a Linux server this can be enabled by adding

port 443

To the file /etc/ssh/sshd_config and restart the ssh service. Ensure that port 443 is not allready on use for i.e. a web server.

Once you have the jumphost in place configure your computer to use a proxy server to connect to your jumphost. For each of use create an alias for the connection. Edit (or create) the file

 

More about this

https://www.digitalocean.com/community/tutorials/how-to-route-web-traffic-securely-without-a-vpn-using-a-socks-tunnel

 

Leave a Reply