Automatic proxy configuration and SSH tunneling
After not having much luck creating a reliable VPN connection from my home office to the Summersault office network, I was looking for a middle-ground solution that would at least let me access internal website addresses that are otherwise protected by our firewall (e.g. corporate intranet, system status monitoring pages, etc.).
I already knew how to create an SSH tunnel so that my web browser's requests could be directed through the tunnel:
This redirects all local port 8080 traffic to port 80 on "ourproxyhost", which runs an Apache web server with mod_proxy enabled.
The last piece of glue was to find a way to avoid having to manually activate and deactivate the proxy every time I went home. It was only a few clicks in my browser's preferences, but it was always enough to be at least a psychological barrier to making efficient use of this method.
The solution is a very standard one that I just hadn't dabbled with yet: automatic proxy configuration. This is where you tell your browser to automatically configure its proxy settings based on the contents of a javascript-like proxy configuration file (typically named proxy.pac). Here's the contents of my proxy.pac file:
{
if (isInNet(myIpAddress, "12.161.105.128", "255.255.255.192")) {
return "DIRECT";
} else {
if(shExpMatch(host, "intranet.summersault.com")) return "PROXY localhost:8080; DIRECT";
return "DIRECT";
}
}
This says "if my current IP address is in the Summersault office network IP block, don't use a proxy. If it's not in that block, I'm connecting remotely, and so for certain website addresses (in this case, our intranet website), try to use the proxy first, and then try to connect directly.
In my Firefox "Connection Settings" menu, I've selected "Automatic Proxy Configuration" and pointed it to "file:///Users/chris/Library/proxy.pac", which is just a file on my laptop. As long as my SSH tunnel is active, my browser will automatically use the proxy to connect to our intranet when I'm out of the office.
(It looks like there's a tool called autossh which will let me further automate the process by automatically re-establishing the tunnel when I need it. This is getting too easy.)
One Response to “Automatic proxy configuration and SSH tunneling”
Leave a Reply
The opinions expressed by individuals posting in the Summersault Blog are not necessarily those of Summersault, LLC. While we try to insure the quality and accuracy of the information presented here, we make no guarantees about its suitability for any particular purpose.
February 19th, 2005 at 4:35 pm
Another way to make this even easier is to add the tunnelling details to .ssh/config, where you can forget about them:
Host shortname shortname.companyname.com
Hostname shortname.companyname.com
User myuser
LocalForward 8000 webproxy:80