% Options for packages loaded elsewhere
\PassOptionsToPackage{unicode}{hyperref}
\PassOptionsToPackage{hyphens}{url}
%
\documentclass[
]{article}
\usepackage{amsmath,amssymb}
\usepackage{iftex}
\ifPDFTeX
  \usepackage[T1]{fontenc}
  \usepackage[utf8]{inputenc}
  \usepackage{textcomp} % provide euro and other symbols
\else % if luatex or xetex
  \usepackage{unicode-math} % this also loads fontspec
  \defaultfontfeatures{Scale=MatchLowercase}
  \defaultfontfeatures[\rmfamily]{Ligatures=TeX,Scale=1}
\fi
\usepackage{lmodern}
\ifPDFTeX\else
  % xetex/luatex font selection
\fi
% Use upquote if available, for straight quotes in verbatim environments
\IfFileExists{upquote.sty}{\usepackage{upquote}}{}
\IfFileExists{microtype.sty}{% use microtype if available
  \usepackage[]{microtype}
  \UseMicrotypeSet[protrusion]{basicmath} % disable protrusion for tt fonts
}{}
\makeatletter
\@ifundefined{KOMAClassName}{% if non-KOMA class
  \IfFileExists{parskip.sty}{%
    \usepackage{parskip}
  }{% else
    \setlength{\parindent}{0pt}
    \setlength{\parskip}{6pt plus 2pt minus 1pt}}
}{% if KOMA class
  \KOMAoptions{parskip=half}}
\makeatother
\usepackage{xcolor}
\setlength{\emergencystretch}{3em} % prevent overfull lines
\providecommand{\tightlist}{%
  \setlength{\itemsep}{0pt}\setlength{\parskip}{0pt}}
\setcounter{secnumdepth}{-\maxdimen} % remove section numbering
\ifLuaTeX
  \usepackage{selnolig}  % disable illegal ligatures
\fi
\IfFileExists{bookmark.sty}{\usepackage{bookmark}}{\usepackage{hyperref}}
\IfFileExists{xurl.sty}{\usepackage{xurl}}{} % add URL line breaks if available
\urlstyle{same}
\hypersetup{
  pdftitle={ssh-tunnel},
  hidelinks,
  pdfcreator={LaTeX via pandoc}}

\title{ssh-tunnel}
\author{}
\date{}

\begin{document}
\maketitle

\hypertarget{ssh-tunnel}{%
\section{ssh-tunnel}\label{ssh-tunnel}}

\hypertarget{ssh-tunnel-for-http-traffic}{%
\section{SSH Tunnel for HTTP
Traffic}\label{ssh-tunnel-for-http-traffic}}

\textbf{Are You stuck behind a firewall?}

Does your school, library, work, or parents control where you surf and
what ports you have open? Do you surf on such public domains and need
more privacy? Are you sick of failing proxies? If you answered `Y' to
any of these questions then this tutorial is for you.

\textbf{My Story}

My place of employment has a firewall and it blocks nearly all outbound
protocols and many great sites, such as foxhop.net or youtube.com. I
need a way to get around the blocks and not get caught.

.. contents:: Sections

\hypertarget{common-questions}{%
\subsection{Common Questions}\label{common-questions}}

\textbf{What is the best way to get around a firewall?}

Create an SSH tunnel from the work network to your home network.

\textbf{My network administrator is smart, will I get caught?}

No, you will most likely not get caught. All the firewall sees is a
connection to a resource on the internet. When you browse the web using
the tunnel all traffic is encrypted. If a network administrator captured
packets he would only get garbage data. An SSH tunnel is basically a VPN
between two computers or networks. 1337

\textbf{Can a network admin stop a person or computer from tunneling?}

The Admin will typically not know about the tunnel. From his view a tiny
connection is being placed and is normally overlooked. The admin does
have the ability to block the default SSH port 22. You can build your
tunnel over any port (80 or 443).

\hypertarget{article-scope}{%
\subsection{Article Scope}\label{article-scope}}

.. \_Putty.exe:
http://www.chiark.greenend.org.uk/\textasciitilde sgtatham/putty/download.html
.. \_Firefox: http://portableapps.com/apps/internet/firefox\_portable

We will discuss the steps of building an SSH Tunnel for HTTP traffic
between two computers on different networks. This guide will cover both
windows and linux localhosts.

Throughout this guide I will use the following terms, here are the
definitions:

\emph{localhost} The computer at work or school. \emph{remotehost} The
computer or server that is offsite, which has the SSH server running.

\textbf{What you need \ldots{}}

\begin{enumerate}
\tightlist
\item
  Credentials to a remotehost running an SSH server. (openssh-server)
\item
  A localhost computer crippled by a pesky network firewall.
\item
  An SSH client, For windows get Putty.exe\_
\item
  Firefox\_ ( Portable is best )
\end{enumerate}

\textbf{Why is this the best method?}

\begin{enumerate}
\tightlist
\item
  Most of the configuration is done from the localhost (while at school
  or work).
\item
  You don't need admin rights to run Putty.exe\_, just place it on a USB
  drive.
\item
  You don't need admin rights to run Firefox\_ Portable, just place it
  on a USB drive.
\item
  No changes need to be made on the remotehost ssh server.
\end{enumerate}

\hypertarget{ssh-tunnel-created-from-a-windows-localhost}{%
\subsection{SSH Tunnel created from a Windows
localhost}\label{ssh-tunnel-created-from-a-windows-localhost}}

Follow this guide if your localhost (school or work) computer is Windows
based.

Configure the SSH Server
\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde{}

The remotehost just needs to have an SSH server installed, no
configuration is needed.

This server could be running anywhere on the internet, we just need
credentials to login.

To install openssh-server on Debian or Ubuntu linux type:

.. code-block:: bash

sudo apt-get install openssh-server

When I'm at work, I establish an SSH Tunnel to my remotehost webserver
at home.

Keep in mind that this doesn't have to be your server, you just need
credentials for SSH.

Configure the SSH Client
\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde{}
\#. Download Putty.exe\_ if you haven't already, you should follow
along.

\begin{enumerate}
\item
  Double click Putty.exe\_.

  .. image:: http://engineer.siue.edu/puttyConnectScreen.gif
\item
  The `Host Name (or IP address)' box should point to the SSH enabled
  remoteserver.
\item
  Toggle the SSH radio button to set the port to 22. (The native SSH
  port).
\item
  Type a name into the `Saved Sessions' box to save all the settings we
  toggle.
\item
  Click the save button.
\item
  There is a list of categories to the left of the putty window.
\item
  Navigate to: ( Connection \textgreater{} SSH \textgreater{} Tunnel )
\item
  You should be at a menu that is labeled `Options controlling SSH port
  forwarding'.
\item
  Click the `Dynamic' radio button.
\item
  Leave `Destination' text box blank.
\item
  Type `7070' into the `Source port' text box.
\item
  Click the `Add' button.
\item
  Save your configuration by going back to the `Session' category,
  selecting your saved session, and pressing the `save' button.
\item
  Double-click your saved session.
\item
  A black terminal window should appear.
\item
  You will be prompted for a username and password.
\item
  You should be greeted by the server if successful. Leave the putty
  window open.
\item
  \texttt{Configure\ Firefox...\ \textless{}\#configure-firefox-to-use-the-ssh-tunnel\textgreater{}}\_
\end{enumerate}

\hypertarget{ssh-tunnel-created-from-a-linux-localhost}{%
\subsection{SSH Tunnel created from a Linux
localhost}\label{ssh-tunnel-created-from-a-linux-localhost}}

Follow this guide if your localhost (work or school) computer is Linux.

Create the tunnel
\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde\textasciitilde{}

Open a terminal or console window, and enter the following command:

.. code-block:: bash

ssh -D 7070 user@remotehost\_ip

You will be prompted for credentials on the remotehost.

All you need to do is login to establish the tunnel.

\hypertarget{configure-firefox-to-use-the-ssh-tunnel}{%
\subsection{Configure Firefox to use the SSH
Tunnel}\label{configure-firefox-to-use-the-ssh-tunnel}}

Setup Socks 5 proxy.

\begin{enumerate}
\item
  Open Firefox\_.
\item
  Click \textbf{Edit} -\textgreater{} \textbf{Preferences}
\item
  Click the \textbf{Advanced} and \textbf{Network} tabs.
\item
  Click the \textbf{Settings\ldots{}} button.
\item
  Click the \textbf{Manual Proxy Configuration} radio button
\item
  In \textbf{Socks Host} type \emph{localhost}. In port type
  \emph{7070}.
\end{enumerate}

.. image:: /attachment/ff-settings.jpg :align: left

You should now be able to browse the Internet using your remote
connection. All data will be passed through the remote hosts internet
connection. All traffic will be encrypted between the localhost and the
remotehost.

\hypertarget{tunnel-to-multiple-vnc-hosts-behind-a-firewall}{%
\section{Tunnel to multiple vnc hosts behind a
firewall}\label{tunnel-to-multiple-vnc-hosts-behind-a-firewall}}

.. code-block:: bash

ssh -L :: @

ssh -L 31337:remote.foxhop.net:5900 user@foxhop.net

ssh -L 31338:remote2.foxhop.net:5900 user@foxhop.net

Then open vnc and point to 127.0.0.1:31338 or 127.0.0.1:31337

\hypertarget{tunnel-dns-requests-in-firefox}{%
\section{Tunnel DNS requests in
firefox}\label{tunnel-dns-requests-in-firefox}}

about:config

network.proxy.socks\_remote\_dns user set boolean true

\hypertarget{remote-port-forwarding-a-service-over-tunnel}{%
\section{Remote port forwarding a service over
tunnel}\label{remote-port-forwarding-a-service-over-tunnel}}

In this scenario we are running a development web server (port 8888) on
our workstation (joe) from our home network. We would like to grant
access to this development web server to people on the work network. We
have ssh access to a host (mary) on the work network.

\begin{enumerate}
\item
  We must enable GatewayPorts in mary:/etc/ssh/sshd\_config to allow
  binding to 0.0.0.0 instead of 127.0.0.1:

  .. code-block:: config

  \# Allow this host to bind forwarded ports to 0.0.0.0 instead of
  127.0.0.1 \# Service will appear to run on this host, but will get
  forwarded over tunnel GatewayPorts yes
\item
  We create a remote port forwarding tunnel from joe to mary:

  .. code-block:: bash

  \# -g means gateway -R means remote port forwarding \#
  prompt:\textasciitilde\$ ssh -g -R :: @ user@joe:\textasciitilde\$ ssh
  -g -R 8888:127.0.0.1:8888 user@mary
\item
  When the tunnel opens, verify that mary is binding/listening to
  0.0.0.0:8888:

  .. code-block:: bash

  user@mary:\textasciitilde\$ sudo netstat -nap \textbar{} grep 8888 tcp
  0 0 0.0.0.0:8888 0.0.0.0:* LISTEN 17921/0\\
  tcp6 0 0 :::8888 :::* LISTEN 17921/0
\end{enumerate}

\textbf{Now people at work can access the home workstation web server
running on joe by connecting to \http://mary:8888 !}

\end{document}
