Scribd
Upload
174 views6 pages

Tunnel HTTP Thru SSH

This document provides instructions for tunneling HTTP traffic through SSH using Squid to ensure web traffic is encrypted when connecting from unsecured networks. There are five main steps: 1) setup SSH and Squid on a home Linux box, 2) open necessary ports on the home firewall, 3) install and configure Putty on a remote Windows box to connect to the SSH server and setup port forwarding, 4) configure the browser to use localhost as the proxy for HTTP traffic which will be tunneled through the SSH connection. This allows one to securely browse the internet from insecure networks like conferences by tunneling all web traffic to the home server before it leaves the private network.

Uploaded by

cretufi
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
174 views6 pages

Tunnel HTTP Thru SSH

This document provides instructions for tunneling HTTP traffic through SSH using Squid to ensure web traffic is encrypted when connecting from unsecured networks. There are five main steps: 1) setup SSH and Squid on a home Linux box, 2) open necessary ports on the home firewall, 3) install and configure Putty on a remote Windows box to connect to the SSH server and setup port forwarding, 4) configure the browser to use localhost as the proxy for HTTP traffic which will be tunneled through the SSH connection. This allows one to securely browse the internet from insecure networks like conferences by tunneling all web traffic to the home server before it leaves the private network.

Uploaded by

cretufi
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 6

Tunnel HTTP thru SSH Using Squid

Created October 3, 2005


by Bruce A. Westbrook
Revisions:
December 12, 2006 BAW Updated wording for public distribution

Introduction
This document describes the process of tunneling web traffic out from an unsecured network to
ensure that your traffic is not being sniffed. This is ideal for when your out at a conference
(particularly security conferences like BlackHat or SANS or DefCon where people are going to be
screwing with the networks, especially the wireless, looking for interesting traffic) and you want to
keep your traffic as confidential as possible. It also works for other aspects, such as
circumventing a secured network in an office environment to avoid the firewall, web content
filtering, port filtering, etc. that may be taking place. By tunneling your connections to your own
server on the net running SSH we will be able to encrypt and therefore hide your traffic.
To accomplish this, I will detail how to perform HTTP tunneling via SSH from your office,
conference, wireless web caf, etc. to your home and then out to the net. You can tunnel other
traffic in a similar manner. There are essentially five steps: setup SSH and on your home box,
setup Squid on your home box, poke a hole through your home firewall to your SSH box, setup
Putty on your remote Windows box, and finally setup your browser.
As long as you have any TCP port out of the network youre on you can setup your remote SSH
box to listen on that port. But for the sake of these instructions will assume that wherever you are
you have uninhibited access outbound on TCP port 443.

Requirements
The requirements for accomplishing this are pretty simple:
Home linux box (these instructions are based on Red Hat Fedora)
Ability to either place your home linux box directly on the Internet (properly protected with
iptables, of course) or forward a port through whatever firewall youre using
A Putty SSH client

For PublIc DIstrIbutIon

Procedures
Page 2

Setup SSH

Install SSH

Description
Install the SSH daemon on your home linux box. Note that the specific
steps outlined here are for Red Hat Fedora distributions. Adopt the
steps as needed for your distribution.
yum install openssh
yum install openssh-clients
yum install openssh-server

Configure SSH

Configure SSH to use a port that you can connect to from your office.
This may mean using a port other then port 22 for SSH such as port
80 or 443 if your office is filtering egress traffic that strictly. For these
procedures, well set it to port 443 (of course, this means you cant also
be running a secure web server on port 443 on this box):
vi /etc/ssh/sshd_config
Unremark the Port line and change 22 to 443
Port 443
Now you need to ensure that iptables is allowing connections to your
SSH port. One way to do this is via the GUI:
1. Application > System Settings > Security Level
2. In the Other Ports dialog box, type 443:tcp
3. Click OK
Or from the command line, you would execute something like this:
iptables D INPUT j DROP
iptables A INPUT p tcp --dport 443 j ACCEPT
iptables A INPUT j DROP
service iptables save
service iptables restart

For PublIc DIstrIbutIon

Procedures
Page 3

Setup Squid

Install Squid

Description
Install Squid proxy on your home linux box.
yum install squid

Configure
Squid

To configure squid to listen on the network we need to add three simple


lines to the configuration.
1. vi /etc/squid/squid.conf
2. Locate the line http_access allow our_networks
3. Add the following two lines immediately after the above line,
substituting your own network schema as appropriate or using
0.0.0.0 to allow everyone:
acl localnet src 0.0.0.0/0.0.0.0
http_access allow localnet
4. Save and exit the file
5. Set squid to start automagically at boot
a. chkconfig squid on
b. chkconfig --list squid
6. Start Squid
a. service squid start

Home Firewall

Open
Necessary Port

Description
You now need to open the port on your home firewall to allow access to
your SSH/Squid box via the port you configured for SSH. So if you are
listening on port 443 for SSH, forward port 443 on your home firewall to
your linux box.

Setup Putty

Install Putty

Description
Download Putty from
http://www.chiark.greenend.org.uk/~sgtatham/putty/
Putty is simply an executable there is not install. To make it easier to
user from the CLI, either put the putty.exe in your Windows directory or
add a path to wherever you drop putty.exe.

Configure
Putty

To configure Putty to use your SSH tunnel, perform the following:


1. Under Session, enter your home computers public hostname
or IP address (note that the example screenshot shown below
has a private IP address)
2. For Protocol, select SSH
3. For Port, enter 443
4. For Saved Sessions, enter a name for your connection (e.g.
SSH Tunnel)

For PublIc DIstrIbutIon

Procedures
Page 4

Now we need to configure putty to connect ports 80 and 443 (web


browsing) on the local host to the proxy port of 3128 (Squid) on the
remote host (your home PC).
5. Navigate to Connection > SSH > Tunnels
6. For Source Port, enter 80
7. For Destination, enter the private IP address of your home
linux/squid machine then :3128 (e.g. 192.168.1.250:3128).
8. Select Local

For PublIc DIstrIbutIon

Procedures
Page 5

9. Click Add
10. Your Forwarded port screen should now look like this:

For PublIc DIstrIbutIon

Procedures
Page 6

11. Navigate back to the Session screen and click Save


12. Finally, click Open to establish your SSH tunnel and login

Setup Browser

Configure your
Browser

Description
To use your secure tunnel with a browser, you simply point it to your
localhost using the port(s) you setup in the SSH Tunnels portion of
Putty.
As an example, heres the Internet Explorer settings:
1. Go to Tools > Internet Options > Connections > LAN
Settings > Advanced.
2. For Address, enter localhost
3. For Port, enter 80
While for Firefox 1.x, the settings are:
1. Go to Tools > Options > Connection Settings
2. Select Manual proxy configuration
3. For HTTP Proxy, enter localhost
4. For Port, enter 80
Youre done! Browse to your hearts delight!

For PublIc DIstrIbutIon

You might also like