I have a basic understanding of tunnelling

The Remote system has a web server installed and connects to internet using a LAN proxy server.

I can tunnel into Remote Computer(Dynamic Port Forwarding) using putty. Using the SOCKS proxy ,I get access to the server installed on the remote system but not the Internet.

How to I get access to internet ??

  • good question.. Perhaps an SSH -L PORTA: that forwards to of the proxy on the remote computer. so if the remote computer has a proxy at port 5678 you could do SSH -L 1234: and(at the local computer) point your web browser to port 1234 – barlop Sep 23 '14 at 9:01
  • and i suppose you'd want two tunnels.. one to browser the internet through your proxy, and one to access your web server. you could do 2 ssh connections each with ssh -L, or, I think you can do -L twice.. like ssh -L PORT: -L PORT: – barlop Sep 23 '14 at 9:29

Because you say that you can tunnel to the machine i would recommend running a proxy server on the machine you are sitting at, then mapping a port on the remote machine to the local proxy port. Then on the remote machine set the proxy to itself on the mapped port. Any internet requests will get mapped via your proxy server to the internet.

    internet --- your machine with proxy on port 8080 --- ssh tunnel mapping 8080(local) to 8080(remote) ---- remote machine (http://localhost:8080 as proxy)

    SSH -L 8080:

your ip as seen by remote machine =


One SSH tunnel can only connect to one chosen internet host. There is no way to create just one tunnel to serve multiple internet connections like a proxy. Or I have not known any existing technology of it.

  • yeah though i'm not even sure what one tunnel to serve multiple hosts would mean.I see'tunnel'as more of an adjective for a connection that encapsulates some other application layer protocol.the language of a conneciton to serve multiple connections is very loose.There is ssh -D where a port is created and you connect and at the forwarding end it connects to multiple hosts. not just "like" a proxy but it is a proxy when with -D.Said to be one tunnel.Also an SSH connection can tunnel multiple connections..though I think that would be multiple tunnels as tere are multiple entry and exit points. – barlop Sep 23 '14 at 22:36
  • Thanks. You are correct. And I haven't noticed the ssh's -D option before. Learned something today. :) – Johnny Wong Sep 24 '14 at 2:55
  • many ssh tutorials mention -L -R and -D. (-R being listen at sshhd end,the remote end, and forward at ssh.exe end, aka reverse ssh tunnel). And there's no remote/reverse form of -D though people do it via ssh -D to make the proxy-ssh tunnel thing, and ssh -R to forward to it. i'm not sure if that's possible in one ssh -D 1234 -R ... but i've seen it done in two separate ones. ssh -D...<ENTER> ssh -R ...<ENTER>. – barlop Sep 24 '14 at 9:46

You are most of the way there, I think, since you mentioned the use of a SOCKS proxy. With ssh, you can setup your own local SOCKS proxy server on your local machine, tunneled through the ssh connection; e.g. :

ssh -D 3128 user@remote.host.com

Then, you need to tell your browser to use that local proxy server to connect to the internet. For Firefox, these settings are in Preferences >> Advanced >> Network >> Connection. You can then set the Manual Proxy Configuration >> SOCKS Host to localhost and 3128.

Note that is static and you'll need to update that every time you connect/disconnect.

Additionally, you said that your remote server....

... connects to internet using a LAN proxy server.

I take it the network you connect to via SSH has it's own proxy server for network connections, in which case you might need to get tricky with your settings; hard to be definitive without more information.

Alternatively, depending upon your OS, you might be able to use the system proxy settings, or if you are really adventurous, you can set "Automatic Proxy Configuration URL: to a file. I used to do this when I worked for a company with a draconian "net-nanny" proxy in my way. For example, here is the config file I used - lots of examples, but you'll have to figure out the right settings for you.

// Personal/Portable Proxy Auto Config -- in -*- conf -*- mode
// Point your web-browser or good mail client (e.g. Thunderbird)
// at this automatic configuration script.
// Reasonable references for PAC stuff:
// - http://en.wikipedia.org/wiki/Proxy_auto-config
// - http://findproxyforurl.com/example-pac-file/
// This is not for the weak of heart.  If you want something
// user friendly and still configurable, try:
// - https://addons.mozilla.org/en-us/firefox/addon/foxyproxy-standard

// normal, non-firewalled, non-proxied...
var DOMAIN = ".nomatch"; 
var IPCACHE = "bogus";

var LOCALPROXY = "PROXY localhost:3128";

function MyPACSetup() {
  alert("MY IP = " + myIpAddress());

  PROXY = "PROXY proxy.corporation.com:8080;" +
  DOMAIN = ".nomatch"; 
  IPCACHE = myIpAddress();
  NETMASK = "";

  // Proxy web locally when inside 10.x.x.x nonrouteable
  //if (isInNet(myIpAddress(), "", "")) {
  //if (isInNet(myIpAddress(), "", "")) {
  //if (isInNet(myIpAddress(), "", "")) {
  if (isInNet (myIpAddress(), "", NETMASK)) {
    DOMAIN = ".nomatch";
    SOCKS = "SOCKS localhost:1080";
    PROXY = "SOCKS localhost:1080;" +

  // Proxies when inside 
//  if (isInNet(myIpAddress(), "", "")
//      || isInNet(myIpAddress(), "", "")) {
//    DOMAIN = ".corporation.com";
//    NETMASK = "";
//    PROXY = 
//      //"PROXY lug.corporation.com:3128;" +
//      //"PROXY mspcf01.corporation.com:8080;" +
//      //"PROXY tmpproxy.corporation.com:8080;" +
//      "DIRECT";
//    SOCKS = 
//      //"SOCKS localhost:1080";
//      "SOCKS lug.htc.corporation.com:1080";
//  }

  // Dwight's world
//  if (isInNet(myIpAddress(), "", "")) {
//    PROXY = ""; // + ";DIRECT";
//    SOCKS = "";
//  }

  alert("PROXY = " + PROXY);
  alert("SOCKS = " + SOCKS);
  alert("DOMAIN = " + DOMAIN);

function FindProxyForURL(url, host) {
  // Re-configure proxies when IP changes
  // Handles portables moving around different networks
  if (myIpAddress() != IPCACHE) { MyPACSetup(); }

  //alert("URL: " + url);

  // Testing localhost proxy for wfuzz or other hacking
  if ( host == "localhost" ) {
    alert("localhost: " + host + " -- returning PROXY");
    return LOCALPROXY;

  // local and loopback hosts are always direct
  // should non-routable be here too?
  if ( isPlainHostName(host)
       || dnsDomainIs(host, DOMAIN)
       //|| host == "localhost"
       || isInNet(host, "", "")
       || isInNet(host, IPCACHE, NETMASK)
       ) {
    //alert("Plain/local host: " + host + " -- returning DIRECT");
    return "DIRECT";

  // Mostly for Thurderbird
  // IF host is local or in DOMAIN, above check will succeed
  if (url.substring(0, 5) == "imap:"
      || url.substring(0, 7) == "mailto:"
      || url.substring(0, 5) == "nntp:") {
    //alert("Mail/News protocols - returning SOCKS");
    return SOCKS;

  // Tunnel blocked sites through our SOCKS server
  if ( shExpMatch(host, "*poker*")
       || shExpMatch(host, "*.emusic.com")
       || shExpMatch(host, "www.myspace.com")
       || shExpMatch(host, "*beer*")
       || shExpMatch(host, "*youtube.com")
       || shExpMatch(host, "*.somethingawful.com")
       || shExpMatch(host, "www.rst38.org.uk")
       || shExpMatch(host, "*videodownloader.net")
       || shExpMatch(host, "*javimoya.com")
       || shExpMatch(host, "gnupg.org")
       || shExpMatch(host, "*.asobrain.com")
       || shExpMatch(host, "*climateprediction.net")
       || shExpMatch(host, "*rsscache.com")
       //|| shExpMatch(host, "*winamp.com*")
       // || dnsDomainIs(host, ".windowsupdate.com")
       // || dnsDomainIs(host, "windowsupdate.microsoft.com")
       // || dnsDomainIs(host, ".windowsupdate.microsoft.com")
       ) {
    alert("Corporation Blocked -- returning SOCKS");
    return SOCKS;

//  if (url.substring(0, 5) != "http:") {
//    //alert("NON HTTP -- returning SOCKS");
//    return SOCKS;
//  }
//  if (url.substring(0, 5) == "https:") {
//    //alert("HTTPS -- returning DIRECT + PROXY");
//    return "DIRECT;" + PROXY;
//  }

  // Otherwise use normal proxy
  //alert("Default PROXY");
  return PROXY;

// eof

Note that I even used that config file to proxy out SMTP and IMAP when those were also blocked, so I could get to my personal email via Thunderbird, which also supports the PAC file settings.

As always, YMMV... Hope this helps.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.