Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Involved machines: (client)A -- B -- C(exit)
A/B is cygwin ssh/sshd, C is linux

What I want:

  1. A's http(s) and socks traffic be tunneled through B,C.
    Destination is any IP, so -L alone doesn't work.

  2. A -- B, B -- C traffic must be encrypted. (So I try to use ssh)

What I did the setup:

  1. Proxy server(3proxy) running at C: http(s) at 3998, socks5 at 3999.
    I tested the proxy server. working for both and external IP.

  2. ssh command on A: (I want to forward local :3998 to C:3998, local :3999 to C:3999)
    ssh -At -L 3998:B:6998 userB@B ssh -At -L 6998:C:3998 userC@C
    ssh -At -L 3999:B:6999 userB@B ssh -At -L 6999:C:3999 userC@C
    I tested the multi-hop login: working.

  3. Use as http(s) proxy. Use as socks proxy.

Firefox is not working with either http or socks, complaining that connection is reset.
(cygwin)wget is not working with http

Error message like "channel 8: open failed: connect failed: Connection refused" is showing on C's ssh console.

Details with -vvv:

on A:
   $ export http_proxy=; wget
   --2014-04-13 08:54:14--
   Connecting to connected.
   Proxy request sent, awaiting response... Read error (Connection reset by peer) in        headers.

on C:
   root@C:~# debug1: Connection to port 3998 forwarding to B port 6998 requested.
   debug2: fd 9 setting TCP_NODELAY
   debug3: fd 9 is O_NONBLOCK
   debug3: fd 9 is O_NONBLOCK
   debug1: channel 3: new [direct-tcpip]
   channel 3: open failed: connect failed: Connection refused
   debug2: channel 3: zombie
   debug2: channel 3: garbage collecting
   debug1: channel 3: free: direct-tcpip: listening port 3998 for B port 6998, connect
    from port 65460 to port 3998, nchannels 4
   debug3: channel 3: status: The following connections are open:
     #2 client-session (t4 r0 i0/0 o0/0 fd 6/7 cc -1)

I also tried forwarding in C alone:

(one tty) ssh -vvv -L root@
(another tty) export http_proxy=; wget

It worked, and I am even confused why it didn't work in my setup.

If I use this command, then it works?!

ssh -At -L 3998: userB@B ssh -At -L 6998: userC@C

But these doesn't work

ssh -At -L 3998:ip_of_B:6998 userB@B ssh -At -L 6998:ip_of_C:3998 userC@C
ssh -At -L 3998:ip_of_B:6998 userB@B ssh -At -L 6998: userC@C

Could someone explain it to me?

I have no idea how openssh implements -L so that it behaves so weird.

share|improve this question

You must log in to answer this question.

Browse other questions tagged .