Sharing Campus Resources via SSH Dynamic Port Forwarding (with Practical Tips) · English (unofficial) translations of posts at kexue.fm

As is well known, the two most valuable resources of a campus network are usually: first, IPv6, which is the ideal way to access websites like Google (though not all universities have IPv6); and second, paper databases. Generally, universities purchase download rights for various paper databases (such as CNKI, Wanfang, etc.) for campus users. While there are many ways to access Google, such as via VPN, accessing resources like CNKI is exceptionally valuable for off-campus users. Usually, one has to ask on-campus users to download papers for them, or pay a high price (and it is expensive!).

As a student, the author enjoys both IPv6 and paper database resources at school, which is indeed very convenient. Since I started using OpenWrt routers, I have been thinking about how to share campus network resources. I once considered setting up a PPTP VPN, but it felt a bit complicated (although compared to other VPNs, setting up PPTP is considered very simple, I still didn’t quite like it), and at that time, I hadn’t solved the problem of intranet penetration. Recently, with the help of SSH reverse proxy, I achieved intranet penetration and realized that through SSH dynamic port forwarding, one can actually set up a proxy and achieve remote access to intranet (campus network) resources with almost no configuration required on the router itself. It must be said that SSH is an extremely powerful tool.

Adding a Regular Account

Since the goal is to share, there is no reason to share the root account. Therefore, the first step is to add a proxy account on OpenWrt. For security and confidentiality, this account should not be allowed to actually log into the server to perform operations; it should only be allowed to perform port forwarding.

First, install useradd using the following commands:

opkg update
opkg install shadow-useradd

After installation, add a guest account with the following command:

useradd guest

Then edit /etc/passwd. The last line should look like:

guest:x:1000:1000::/home/guest:

Complete it as:

guest:x:1000:1000::/home/guest:/bin/false

Then add a line to /etc/shells:

/bin/false

At this point, the proxy account setup is complete. You can then change the password using passwd guest. This account must be operated using the ssh -N mode, which means no remote commands are executed. If you try to log in directly via SSH, the login will fail.

Dynamic Port Forwarding

Dynamic port forwarding means that after connecting to the router via SSH from a local machine, a SOCKS proxy can be established locally. Although this proxy is on the local machine, it forwards local requests to the router. The router makes the request, receives the result, and sends it back to the local machine. Through this proxy, the objective is achieved.

On Linux or Mac OS, you only need one line of code to implement dynamic port forwarding and establish a local SOCKS proxy:

ssh -ND 7070 guest@1.1.1.1 -p 22222 -v

As mentioned before, -N is mandatory. The -D parameter is used to specify the listening port. The final -v enables verbose mode, which prints the data stream. Without the -v parameter, there will be no output (some friends feel uneasy if they don’t see any output. ^_^).

After establishing the SOCKS proxy, simply configure the corresponding proxy settings in your browser. Note that you must use a SOCKS5 proxy; do not mistakenly select HTTP. SOCKS4 can also be used, but it does not support IPv6. If you use SOCKS4, IPv6 resources will be inaccessible. If you use Google Chrome, you can use plugins like SwitchyOmega, SwitchySharp, or "Smart Proxy" to easily switch proxies. For other browsers, please find your own solutions. As far as I know, all major browsers currently allow for easy SOCKS proxy configuration. After confirming the proxy is set up successfully, you can check if you can open baidu.com and type "IP" in the search box to see if your IP has changed to the remote router’s IP.

On Windows, the second step is the same, but the first step is different. Since Windows does not have a built-in SSH client, you need to download and install one. When talking about SSH tools for Windows, many people think of PuTTY, but in fact, there is a more useful command-line version—Plink. The usage and parameters of Plink are similar to SSH under Unix, and it is even more convenient (it can specify a login password for automatic login, which SSH cannot do unless you install sshpass). In plink.exe, simply execute the following command:

plink -N -D 7070 guest@1.1.1.1 -P 22222 -pw 123456 -v

The final -pw parameter is used to specify the password, assumed here to be 123456. Note that the -P for specifying the port is uppercase here.

Why not use PuTTY? Many online tutorials suggest using PuTTY to establish a proxy, but I did not find an option in PuTTY corresponding to the -N mode. Therefore, PuTTY is ineffective in this situation. In fact, many online SSH proxies use similar methods to disable remote command execution rights, so Plink is the way to go.

sshuttle

Finally, it is worth mentioning another solution for those with an SSH account: sshuttle. This is a VPN program built on SSH that directly implements VPN functionality without needing to set up a proxy. However, it is based on Python and can only be used on Linux or Mac OS. Interested friends can explore this on their own.

Adding a Regular Account

Dynamic Port Forwarding

sshuttle

Campus Network Sharing