Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have two machines S and C that are on a local network. The way to access Internet from any machine on the network is to use a web proxy, Squid3 is being used. So I can log in to the proxy from only one of the machines at a time, and therefore can't access Internet from the other ones simultaneously.

So I set up an SSH tunnel from C to S. I log in to the web proxy on S. I configure my web browser on C to use the tunnel as a proxy. However, I am unable to access the Internet from C. I do get an error "connection refused" on the terminal where I started the SSH tunnel process.

ssh -fND 8080 user@remotehost

enter image description here

My question is: Since S is also using a proxy itself, do I need to change any more settings anywhere for SSH tunnel to work?

How does S know what to do with the data it receives from C through the SSH tunnel?

Edit : I have now done the following : On S I installed a squid3 proxy server, and I configured C to use the new proxy. This solution works. I dont need the encryption provided by SSH. I want to know this : Is SSH tunneling better than my current solution for any reason other than encryption ? (Please tell me if I should have opened a new question for this).

share|improve this question
@slhck yes that exactly describes my situation. I am using only one ssh command on the client side ssh -fND 8080 user@remotehost. Thanks for the veru useful illustration. – AnkurVj Aug 23 '11 at 17:47
Not a thing -- I added the image and the command to your question. – slhck Aug 23 '11 at 17:49
up vote 1 down vote accepted

Here is the command I use: ssh -g -L192.168.2.1:8190:proxy-server:3128 relay-server

So, I have client machine in local network, a local server, then server that I connect to and finally the proxy server working as HTTP proxy. The proxy and relay server can of course be the same.

I give this command on local server after which clients coming via the interface with address can use the proxy. The option -g is needed for the proxy to be open for anyone, ie. outside of the machine creating the tunnel. Using -g is risky, so you need to specify the local interface to bind to; you don't want to open the tunnel for whole world.

In your image "Proxy" would be both proxy-server and relay-server, "S" the local server and "C" a client using the tunnel.

share|improve this answer
Hi, I am sorry but on running this command on S, I get asked for the root password for the proxy server. Is that the correct behaviour ? I do not have access to the machine running the proxy server. – AnkurVj Aug 23 '11 at 18:45
The relay-server needs to see the proxy, and have access to it. If the machine "S" can access it, then replace the "relay-server" with S. Also, you can give any login to the "relay-server" part with @: like login@relay-server. – Zds Aug 23 '11 at 19:28
> Replace the relay server with S but I thought I was running this command on S ? – AnkurVj Aug 23 '11 at 20:00
Yup. You can write ssh ... user@localhost and it works. – Zds Aug 23 '11 at 21:10

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.