being at home, I know how to establish ssh tunnels between the work gateway. The main thing is for the gateway, to be able to establish a ssh connection with my machine at home. I do this setting the NAT options of the wifi router.

But sometimes I am at the airport. Here, the wifi connection does not allow to establish this kind of connections.

Do you know any other way to do it?


  • google for HTTP tunneling
    – Anonymous
    Sep 25, 2009 at 10:43
  • sorry, I didn't realize about server fault, next time I will put there such questions
    – Werner
    Sep 25, 2009 at 10:44
  • Not really a SO question, have you seen superuser.com ?
    – Kiar
    Sep 25, 2009 at 10:44

4 Answers 4


I recommend the 'soht' project to create tunnels over HTTP.
You have to know the proxy hostname and port.
At home you need a running tomcat server with 'soht' deployed, maybe in conjunction with an apache reverse-proxy.


When at an airport, you typically have to pay for internet connection. When you open a browser, you will be taken to a page where you can buy connection, or type in a username/password if you have a subscription. Unless you do so first, any network communication will be disabled.

If that doesn't help, try changing the SSH port no. to one used for stuff that would normally be allowed, e.g. SMTP or POP3 port. Port 81 is often also a good candidate.


Are you trying to create an outbound tunnel from your PC to work, or an inbound tunnel from work to your PC?

If the former, then you're probably running into a situation where the provider's firewall is blocking everything other than HTTP/HTTPS over specific ports. This is unusual: I can't remember the last time that I've had arbitrary outbound traffic blocked, and usually have no problem using SSH to get to my home machine. If you are getting blocked, then some sort of HTTP tunneling (as suggested by other posters) would be the only option -- although I can't begin to imagine the overhead this must imply.

If the issue is that you can't open a connection from work to your airport-situated laptop (and I'm assuming this is what you want since you talked about NAT settings), well, you're going to be out of luck for a direct connection. You almost certainly have a private IP behind the airport's firewall, so there would be no way to route packets to you.

The alternative is to establish two tunnels, with a trusted host (your home machine) in the middle. You'll need to open two ports in your firewall: your normal SSH port (22, but see below), and another port -- say, 2201. From work, open a reverse tunnel to your home machine, using an argument such as 2201:localhost:22 -- all connections to port 2201 on your home machine will be tunneled to port 22 on your work machine. Then open a forward tunnel from your laptop to your home machine, using an argument such as 22:localhost:2201 -- all connections to port 22 on your laptop will be forwarded to 2201 on the home machine.

This is, of course, not an optimal setup. Not only do you have a handoff in the middle, but if you have ADSL (like I do) you'll be hit by the slow upload speeds. All-in-all, traditional VPN is probably a better choice (again an assumption: you're using SSH because your traditional VPN is too slow).

On a side note: opening port 22 on your home firewall is not a good idea: sooner or later you will be attacked. Even if it doesn't lead to getting hacked, the attackers will chew up bandwidth and disk space (the first and only time it happened to me, the auth log grew to many megabytes within the space of an hour -- then I hit slapped myself for being stupid and closed the port -- doesn't matter that my passwords aren't subject to dictionary attack, it's still a bad idea to leave doors unlocked).

Edit: to get sshd to listen to additional ports, edit the file /etc/ssh/sshd_config (Windows users, you're on your own), and add additional Port directives (look for the existing "Port 22" entry):

# What ports, IPs and protocols we listen for
Port 22
Port 2201
  • Switching to an non-standard port will delay, but not definitively protect. Opening a connection to the ssh port (22 or 2201 or whatever) will show "SSH-1.99-OpenSSH_5.1" before anything else. Sep 25, 2009 at 14:30
  • Cann't the ssh daemon be configured not to output the banner? I'm pretty sure it can, although I don't remember how/where
    – Mala
    Jan 16, 2010 at 7:04

Unless I misunderstand your question, the airport firewalls are blocking your outgoing connections on port 22. In order to bypass this, tunnel your ssh connections over DNS: http://www.boingboing.net/2004/06/21/tunneling-ssh-over-d.html

Note that in doing so you will almost certainly be able to bypass their "paid-network" systems - simply establish this connection then tunnel your HTTP connections through it.

If bypassing their payment scheme is your goal, you'll get a far better connection if you sit in an area where others have paid, and run airodump-ng or the like to find the mac address of someone sending/receiving a lot of packets with one of these paid networks. Simply spoof his mac address and you'll have internet access.


Both of the above techniques are heavily in the moral grey-area. Piggybacking on someone else's connection may even be illegal, I'm not sure, but in any case you will slow down his service, effectively stealing bandwidth from him. While getting free internet via ssh-over-dns does not negatively impact the paid services of others, you are still utilizing resources the company must pay for and receiving a paid service for free, so I would suggest first paying for their service even though it is not necessary, and THEN creating the tunnel. Also consider that the airport might be blocking outgoing 22 for a good reason (although god only knows what that might be).

These are all things you should consider before trying to acquire a paid service for free, or trying to expand your service beyond what the provider offers.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.