How to create an SSH tunnel between a Linux server and a Windows client

The idea of ​​building a SSH tunnel is to encrypt all connections (regardless, for example, if you go to an https or http page) and connect to Internet through a secure channel. This "safe" channel is nothing more than a server configured for this purpose. This server could be, for example, in your home.

The "disadvantage" of this method is that you always have to have this machine turned on and configured correctly to function as an SSH server, but it allows you to substantially improve the security of your connection and even evade the connection restrictions imposed by network administrators ( for example, your job).

I hear you ask: can this really help me? Well, let's assume the following scenario: you are in an internet cafe or restaurant with free Wi-Fi and you need to make a bank transfer or other important operation. Of course, it is always recommended to carry out these types of transactions in a safe environment. However, there is a solution: an SSH tunnel. In this way, we can connect to the Internet through our "secure" server.

This method is also useful for circumventing the restrictions imposed on the connections of many work environments. Can't access YouTube from work? Well, an SSH tunnel may be the solution, as all requests will be made through your "secure" server. In other words, as the IP of your secure server is not blocked (yes, on the other hand, YouTube's) you will be able to "evade" this restriction (not being able to access YouTube) since for the administrator of your company's network your machine was only chatting with your "secure" server and has no idea that through it you are actually browsing a lot of pages.

In this tutorial we are going to explain the "typical" case: Linux server, Windows client.

Configure Linux server

1.- Install the SSH server. To do this, I opened a terminal and ran:

En Ubuntu:

sudo apt-get install openssh-server

En Arch:

pacman -S openssh

En Fedora:

yum -y install openssh-server

Ready. You will now be able to access the Ubuntu (SSH server) with an SSH client.

2.- Once installed, it is useful to review the configuration file:

sudo nano / etc / ssh / sshd_config

From this file you will be able to configure your SSH server at ease. My recommendation is to modify only 2 parameters: port and allowusers.

To avoid possible attacks it is advisable to change the port that SSH will use. By default it comes with the value 22, you can choose another that suits you best (for the purposes of this tutorial we chose 443 but it can be any other).

The Allowusers parameter allows you to restrict access by user and, optionally, the host from which you can connect. The following example restricts access to the SSH server so that only so-and-so users can do so from hosts 10.1.1.1 and 10.2.2.1.

AllowUsers so and so@10.1.1.1 mengano@10.1.1.1 so and so@10.2.2.1 mengano@10.2.2.1

Configure the router

In case your server is behind a router, it is necessary to configure the latter so that it does not block incoming connections. More specifically, you have to configure.

Before going to the point and showing the necessary configuration it seems prudent to explain a little what port-forwarding consists of.

Suppose you have a local network of 3 machines, all of them behind a router. How does an incoming connection (from SSH, as would be our case) to communicate with machine 1 of our local network? Don't forget that "from the outside" the 3 machines, although they have local IPs, share a single public IP through which they connect to the Internet.

The solution to the aforementioned problem is port-forwarding. In this way, when incoming connections are received to port X of our public IP, the router will refer it to the corresponding machine. In this way, whenever we connect through that port, we know that the router is going to redirect us (hence port-forwarding) to the corresponding machine. All this, obviously, must be configured in the router.

The port-forwarding configuration varies a bit according to the router you are using. The most practical is to visit portforward.com, choose the router model you are using and follow the steps described there.

Configure the Windows client

To connect from Windows, it is practical to use the PuTTY tool as an SSH client.

1.- The first step is to download PuTTY

As you can see on the PuTTY download page, there are several versions available. I recommend downloading the portable version of the program: putty.exe. The advantage of choosing the portable version is that you can always carry it with you on a pendrive and run the program from any computer, wherever you are.

2.- Open PuTTY and specify the IP (public) and port of the server to which the SSH client should connect. How to find out the public IP of your server? Easy, just google "what is my public ip" to find thousands of pages that offer this service.

3.- In case the "client" is behind a proxy, don't forget to configure it correctly. In case you are not sure what data to enter, open Internet Explorer and go to Tools> Connections> LAN Settings> Advanced. Copy and paste the data that appears there in PuTTY, as seen in the image below. In some cases, you may need to enter a username and password.

4.- It is necessary to enter the "local" port-forwarding data to build the SSH tunnel. Go to Connection> SSH> Tunnels. Here the idea is the following, we have to tell PuTTY which connections to "divert" to our secure server. To do this, we must choose a port.

My recommendation, especially if the machine is behind a proxy, is that you choose port 443 since it is the one used by SSL to make secure connections, which will make it difficult for the administrator to discover what you are doing. On the other hand, port 8080 is the one used by HTTP (which is not a "secure" connection) so an experienced network administrator may be suspicious and may even have blocked the port for other types of connections.

In Destination, re-enter the IP of the secure server, followed by a colon and the port you opened in the dot titled "Configure the router" and in the ~ / .ssh / config file. For example, 192.243.231.553:443.

Select Dynamic (which will create a SOCKS connection, which we will use in the next point) and click Add.

5.- I went back to the main PuTTY screen, clicked Save and then Open. The first time you connect to the server, an alert message like the one below will appear:

6.- Then, it will ask for your username and password with access to the server.

If everything went well, once the login is done, you should see something like what you see below ...

7.- Finally, without closing PuTTY, open and configure Firefox (or your favorite browser) to connect to the Internet through PuTTY.