How to create a local-remote-local tunnel to a specific port using ssh

Question

I'm able to establish an ssh connection from my windows computer (localhost - eth1) to my linux computer (remotehost - eth0) by doing:

ssh [email protected]

Instead of using that, because I use non-standard ports I have to specify the port:

ssh -p remoteSSH [email protected]

I then forward http and ssl to the remotehost's http and ssl ports. I have some services I want to use on the linux box so I use this:

ssh -L 80:127.0.0.1:80
ssh -L 443:127.0.0.1:443

Lastly, I try to "securely" reverse forward traffic from the (localhost) through the (remotehost) and back to the (localhost). But, with this connection I need the socks proxy to be 127.0.0.1:proxy1. I was successful in creating a non-socks proxy which points proxy1 to the [specific port aka proxy2] on the (localhost) via the above forwarding method but I'm trying to avoid having to constantly modify html files to point to the proxied port.

When I used putty, I had connectivity for all the above connections except for the dynamic socks connection which only worked to forward standard http/s traffic. I do not want to create a proxy to the internet. I've stopped using putty because it drops connections and it crashes whenever forwarding traffic. The latter is a known bug:

http://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html

These features were new in beta 0.61 (released 2011-07-12):
    Bug fix: corruption of port forwarding is fixed (we think).

These features were new in beta 0.59 (released 2007-01-24):
    Bug fix: SSH-1 connections tended to crash, particularly when using port forwarding.

These features were new in beta 0.58 (released 2005-04-05): 
    Fixed crashing bug with remote port forwarding.

These features were new in beta 0.53 (released 2002-10-01): 
    Various bug fixes, including (with luck) much greater stability in high-traffic port forwarding situations.

So, on the windows box, I moved to cygwin for openssh. The command I've come up with so far is:

ssh -t -t -L 80:127.0.0.1:80 -L 443:127.0.0.1:443 -p remoteSSH [email protected] -R proxy1:127.0.0.1:randomport "ssh -D randomport 127.0.0.1"

To test the connection from proxy1 to proxy2, in Firefox I set:

HTTP Proxy:                 Port:
SSL Proxy:                  Port:
FTP Proxy:                  Port:
SOCKS Host: 127.0.0.1       Port: proxy1
SOCKSv5
No Proxy for:

I get a response saying the proxy server is refusing connections. I've created rules in the Windows box to allow the connections. I disabled my Windows firewall and allowed the connection in iptables on the linux box via:

$IPTABLES -A OUTPUT -o eth1 -p tcp -m tcp -s 192.168.1.100 -d 192.168.1.200 --dport randomport -j ACCEPT

iptables is already setup to allow local traffic. I use password protected host-based private key authentication. I have syslog-ng (cygwin) logging ssh.

Perhaps, as an alternative or in addition to the question, someone can direct me to linux and/or Windows tools that can help me diagnose the problem. For Windows, I have Windows System Control Center with Sysinternals Suite and Nirsoft Utilities. The Windows System: Windows 7. Linux: Slackware 64

http://technet.microsoft.com/en-us/sysinternals/bb842062.aspx

http://www.kls-soft.com/wscc/

http://www.nirsoft.net/instinfo.html

Answer 1

I decided to use a time tested approach of trial and error. This is what allowed access to proxy2:

ssh -t -t -D proxy1 -R proxy2:127.0.0.1:proxy2 -p remoteSSH [email protected]

In Firefox, I can now enter:

https://127.0.0.1:proxy2

which will send the connection through the tunnel (proxy1) to the local proxy (proxy2) essentially becoming a local-remote-local tunnel to a specific port.

While proxy2 is accessible through proxy1, proxy1 is allowed access to the internet. To limit what the proxies were allowed to access, I added a PermitOpen entry in the sshd_config file of the remote host at 192.168.1.100 according to the man page:

http://www.openssh.com/cgi-bin/man.cgi?query=sshd_config

PermitOpen 127.0.0.1:proxy2 127.0.0.1:80 127.0.0.1:443