HTTP tunneling

From ArchWiki
Revision as of 14:19, 7 December 2014 by Kynikos (talk | contribs) (split See also section and group sections under the same "Creating the tunnel" parent)
Jump to: navigation, search

In networking, tunneling is using a protocol of higher level (in our case HTTP) to transport a lower level protocol (in our case TCP).

Creating the tunnel

Using httptunnel

httptunnel, available in the official repositories as httptunnel, creates a bidirectional virtual data connection tunneled in HTTP requests. The HTTP requests can be sent via an HTTP proxy if so desired. This can be useful for users behind restrictive firewalls. If WWW access is allowed through a HTTP proxy, it's possible to use httptunnel and, say, telnet or PPP to connect to a computer outside the firewall.

If you already have a web server listening on port 80 you are probably going to want to create a virtual host and tell your web server to proxy request to the hts server. This is not covered here.

If you do not have any web server listening on port 80 you can do:

  • on the server:
hts --forward-port localhost:22 80
  • on the client:
htc --forward-port 8888
ssh -ND user@localhost -p 8888
Note: As SSH thinks it is connecting to localhost it will not recognize the fingerprint and display a warning.

You can now use localhost:8888 as a SOCKS proxy.

Using proxytunnel

Install the proxytunnel package from the official repositories.

$ ProxyCommand /usr/bin/proxytunnel -p some-proxy:8080 -d

Using openbsd-netcat

Install the openbsd-netcat package from the official repositories.

To open a connection using the openbsd netcat version:

$ ssh user@final_server -o "ProxyCommand=nc -X connect -x some-proxy:$proxy_port %h %p"

Using the tunnel

See Using a SOCKS proxy.

Tango-edit-clear.pngThis article or section needs language, wiki syntax or style improvements. See Help:Style for reference.Tango-edit-clear.png

Reason: The content below has been merged from Tunneling SSH through HTTP proxies using HTTP Connect and is in the process of being integrated with the page above. (Discuss in Talk:HTTP tunneling#)

To open the connection to the server running the SSH daemon we will use the HTTP CONNECT method which allows a client to connect to a server through an HTTP proxy by sending an HTTP CONNECT request to this proxy.

Tip: If your proxy does not support the HTTP Connect method, see HTTP Tunneling.

Creating the tunnel

For this we will use corkscrew, available in [community], which is «a tool for tunneling SSH through HTTP proxies».

Opening an SSH connection is pretty simple:

ssh user@server -o "ProxyCommand corkscrew $proxy_ip_or_domain_name $proxy_port $destination_ip_or_domain_name $destination_port"

but that just opens a shell yet what we want is a SOCKS tunnel, so we do this:

ssh -ND $port user@server -o "ProxyCommand corkscrew $proxy_ip_or_domain_name $proxy_port $destination_ip_or_domain_name $destination_port"

which creates a SOCKS proxy on localhost:$port.

Tunneling Git through HTTP proxies

Restrictive corporate firewalls typically block the port that git uses. However, git can be made to tunnel through HTTP proxies using utilities such as corkscrew. When git sees the environment variable GIT_PROXY_COMMAND set, it will run the command in $GIT_PROXY_COMMAND and use that program's stdin and stdout, instead of a network socket.

Create a script file

#! /bin/bash

corkscrew proxyhost proxyport $*



Now, git should be able to tunnel successfully through the HTTP proxy.