Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Now if I am not mistaken, an SSH tunnel of port 80 to a web server on port 80 should allow my port 80 to tunnel through that server, correct? However, when I set up a tunnel and access a website, my log still appears to come from my home computer instead of the server's IP. Any ideas why?

I use the following command but all it appears to do is just SSH into the host in the terminal:

ssh root@webserver -L 80:127.0.0.1:80

share|improve this question
    
I may be wrong, but I think you want ssh -f root@webserver -L LOCALPORT:HOST:REMOTEPORT-N. -f is for ssh to go to the background, -N tells OpenSSH to not execute a command on the remote system. Of course, I hope you aren't actually using root as the user... –  nerdwaller Jan 24 '13 at 8:51
    
Thanks, I'll give it a shot. Yes, I am using root because for some silly reason su is required in order to set up the tunnel. –  Peter Jan 24 '13 at 9:02
    
@Ryan: I don't think it is a "silly" reason, I think that it is because you are trying to tunnel a protected system port (e.g. <1024) for which you need system rights. –  Julian Knight Jan 24 '13 at 22:05

2 Answers 2

Just tried this and confirmed that it was working:

ssh -ND 8080 username@domain.com

Root is required to bind the local port 80 on your machine since it's a reserved port (and 8080 is the common alternate). To forward just your browser traffic you could set Firefox / Chrome / Whatever to use a Socks proxy "localhost" on "8080".

Try it without root, works for me on a webserver that I do not have root access to.

share|improve this answer
    
Ha, I should have read down to here before putting in my comment on the question itself. –  Julian Knight Jan 24 '13 at 22:07
    
@JulianKnight No worries! Perks of a community based system - nothing wrong with reiterating the point (and expanding on it to mention <1024, which I omitted). –  nerdwaller Jan 24 '13 at 23:16

Once the tunnel is set up (with -L) you need to change the URL you use, e.g. http://127.0.0.1/ or if the site name must match due to the virtual-hosting set up then you'll need to add that to your desktop hosts file:

127.0.0.1    www.domain.com

You could define an alias on the server vhost so that you can use one name for 127.0.0.1 like "test.domain.com", and the real name to go directly, if that's ever going to be useful -- forgetting to remove entries from the hosts file is a good way to cause confusion. Depends on how the site works.

To forward port 80 you only need to be root on the desktop, ''not'' the webserver. I'd strongly suggest not allowing ssh login for root.

Using a non-privileged port may work, again depending on your site:

ssh user@webserver -L 1080:127.0.0.1:80

and use the URL http://127.0.0.1:1080/ .

Using a SOCKS proxy (-D) as suggested may cause some surprises, depending on SOCKS/DNS/firewall/NAT configuration.

(On linux as an alternative to being root for reserved ports you can use POSIX capabilities, see http://stackoverflow.com/questions/413807/is-there-a-way-for-non-root-processes-to-bind-to-privileged-ports-1024-on-l , however this will not work on standard versions of OpenSSH as it has an extra hard-coded check on port numbers, unless compiled with NO_IPPORT_RESERVED_CONCEPT defined. The answers to the linked question have various other solutions to that.)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.