Threat Level: green Handler on Duty: Guy Bruneau

SANS ISC: Tip of the Day: Secure Surfing at the Coffee Shop (or Hacker Conferences) - SANS Internet Storm Center SANS ISC InfoSec Forums

Watch ISC TV. Great for NOCs, SOCs and Living Rooms:

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Tip of the Day: Secure Surfing at the Coffee Shop (or Hacker Conferences)
This tip is how to use SSH port forwarding to browse the web at your favorite coffee shop (or hacker conference).

1) Setup a machine on your home network.  If you don't have a static IP address, then use dynamic DNS.

2) On this machine setup squid ( and bind it only to localhost.  Do this with the "http_port" line in squid.conf.  This will prevent others on the Internet from abusing your open proxy.

3) Setup SSHD on this machine.  And do yourself a favor, require SSH key authentication and run SSHD on a port that is NOT 22.  This will keep all those brute force SSH grinders from filling your log files.

4) At the coffee shop, do ssh -p <sshd_port> -L3128: <user@IP>.  This will setup your SSH tunnel.

5) The most critical piece is to configure your web browser to use a proxy.  Host:; port 3128

6) Surf away.  All your web surfing will be encrypted to your home box before travelling to the Internet.  Be advised that your outbound DNS requests are still sent to the local network unencrypted.  But you have at least prevented snooping and/or modification on the HTTP(S) traffic.

You can forward almost any standard TCP application though an SSH tunnel and OpenSSH has recently introduced lightweight VPN features.  But that's a topic for another day.


112 Posts
Aug 16th 2006

Sign Up for Free or Log In to start participating in the conversation!