Sharing Campus Resources via SSH Dynamic Port Forwarding (With Practical Tips)

通过ssh动态端口转发共享校园资源（附带干货） 苏剑林 · 2016-03-07 · Machine Learning OpenWrt router

Sharing campus network resources via SSH dynamic port forwarding (with practical tips)

As we all know, a campus network typically has two of its most valuable resources: one is IPv6, which is the ideal way to access sites like Google (though of course not every university offers IPv6); the other is access to academic paper databases — most universities purchase download rights to some databases (CNKI, Wanfang, etc.) for their campus users. If accessing Google has plenty of alternatives such as VPNs, then for people outside the university, accessing resources like CNKI is especially precious — usually you can only ask someone inside the campus to download it for you, or pay for it yourself (and it's expensive!).

I'm still a student, and I get to enjoy both IPv6 and paper database access at school — it really is great. Ever since I started using an Openwrt router, I've been thinking about how to share these campus network resources with others. I once considered setting up a PPTP VPN, but it felt a bit too complicated (of course, compared to other VPNs, setting up a PPTP VPN is already quite simple, but I still wasn't too fond of it), and back then I hadn't yet solved the problem of NAT traversal. Recently, I managed to achieve NAT traversal using SSH reverse proxying, and in the process realized that SSH dynamic port forwarding can also be used to build a proxy, thereby enabling remote access to resources on an internal network (the campus network) — and almost no configuration is needed on the router itself. I have to say, SSH really is an incredibly powerful tool.

Adding a regular user account

Since we're going to share access, there's no reason to hand out the root account to everyone. So the first step is to add a proxy account on Openwrt, and for the sake of security and confidentiality, this account should not be allowed to actually log in and operate on the server — it should only be allowed to do port forwarding. more

First, install useradd with the following command:

opkg update
opkg install shadow-useradd

Once installed, add a guest account with the following command:

useradd guest

Then edit /etc/passwd. The last line should look something like:

guest:x:1000:1000::/home/guest:

Complete it as:

guest:x:1000:1000::/home/guest:/bin/false

Then add a line to /etc/shells:

/bin/false

At this point, the proxy account has been added. You can then set its password with passwd guest. This account must be used in ssh -N mode, i.e. without executing any remote commands — if you try to SSH into it directly, the login will fail.

Dynamic port forwarding

What's called dynamic port forwarding means that after connecting to the router locally via SSH, you can set up a local SOCKS proxy. Even though this proxy runs locally, it forwards local requests to the router; the router makes the request, gets the result, and sends it back to your local machine. This proxy is what lets us achieve our goal.

On Linux or Mac OS, a single line of code is enough to set up dynamic port forwarding and establish a local SOCKS proxy:

ssh -ND 7070 guset@1.1.1.1 -p 22222 -v

As mentioned earlier, -N is required, and the D parameter is used to specify the listening port. The final -v enables debug mode, which prints out some data flow; without the v parameter there's no output at all. (Some people feel uneasy if they don't see any output. ^_^)

Once the SOCKS proxy is set up, simply configure the corresponding proxy in your browser — note that you should use a SOCKS5 proxy, not accidentally select HTTP. SOCKS4 also works, except that SOCKS4 doesn't support IPv6, so if you use SOCKS4 you won't be able to access IPv6 resources. If you're using Chrome, you can use plugins like SwitchyOmega, SwitchySharp, or "Smart Proxy" to make switching proxies more convenient; for other browsers, please look for your own solution — as far as I know, all mainstream browsers currently make it easy to set up a SOCKS proxy. Once you've confirmed the proxy is set up correctly, try opening baidu.com and typing "ip" into the search box to see whether your IP has changed to that of the remote router.

On Windows, the second step is the same, but the first step is different. Since Windows doesn't come with a ready-made SSH client, you need to download and install one. When people mention SSH tools on Windows, many think of PuTTY, but in fact there's an even more useful command-line version — plink. The usage and parameters of plink are similar to ssh on Unix, and arguably even better (it lets you specify a login password for automatic login, which ssh doesn't support unless you install sshpass). With plink.exe, simply run the following command:

plink -N -D 7070 guset@1.1.1.1 -P 22222 -pw 123456 -v

The final pw parameter is used to specify the password, here assumed to be 123456. Note that the P used to specify the port here is uppercase.

Why not use PuTTY? Many online tutorials describe using PuTTY to set up a proxy, but I couldn't find an option in PuTTY corresponding to the -N mode, so PuTTY doesn't work in this scenario. In fact, many SSH proxy setups found online rely on similar approaches that disable remote command execution, which is exactly why plink becomes necessary.

sshuttle

Lastly, it's worth mentioning that given an existing SSH account, another solution is sshuttle, a VPN program built on top of SSH that directly implements VPN functionality without needing to configure a proxy. However, it's Python-based and only works on Linux or Mac OS. Anyone interested is welcome to explore it further.

Sharing campus network access

At this point, if your browser is using the proxy you've set up, you should be able to access Google, Wanfang, and CNKI normally (if it still doesn't work, try selecting IP-based login on the login page), and you'll be able to download papers from the databases for free.

This truly is the most powerful way to get around the Great Firewall!

Long live the invincible SSH!

For more content, please visit: http://bbs.spaces.ac.cn/topic/show/15