I have the following situation: There are some hosts that are only accessible through an ssh tunnel. Lets say its

I can establish the SSH tunnel and bind the 443 ports needed for the connection to local ports:

ssh -L 1443:example.com:443 -L 2443:other.com:443 -A -l username myproxy.com

This works fine so far - when I call https://localhost:1443, I can open example.com, if I call https://localhost:2443, I can call other.com

The problem: There are some apps that are not aware of this and still try to connect via the regular hostname and port.

Adding the following lines to my hosts file, I can get a step closer to the final solution: example.com other.com

This enables me to call https://example.com:1443 and https://other.com:2443 in my browser - but the port is still a problem. I would need to map BOTH domains to my local port 443 to make it work for other applications.

I guess I will need to have a local proxy server listening on port 443 and forwarding traffic based on hostname to either 1443 or 2443 but this is where I'm lost.

What can I do to enable all apps on my machine to just use the hostname/port but let the traffic go over my SSH tunnel?

  • SSH can create a TAP device, and you could route the ips through that. – davidbaumann Dec 5 at 10:49
  • Do you have a document at hand which describes how I can do that? – Christian Engel Dec 5 at 11:04

Use ssh -D. This will create a SOCKS 5 proxy server on the specified port (usually 1080 or 9050), which you can configure in the browser and access everything through the SSH tunnel.

This works identically with OpenSSH, PuTTY (plink), Bitvise Tunnelier; and does not depend on any operating system-level features.

For example, with ssh -D 9050 running, you can configure Firefox like this:

enter image description here

(Chrome might need a command-line option instead.)

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.