HOWTO: Secure Internet Access using a PuTTY Tunnel and Linux LiveCD Router

There are times when you want to connect to the Internet through unknown and/or insecure network such as the local Cybercafe, WiFi hotspot or while travelling. If you are not careful, you might make it all too easy for someone to sniff your connection and compromise your data.

One of the best ways to secure your connection is to use OpenVPN, but if you do not have openvpn support on your windows machine, PuTTY is very easy to use (just one executable of 350 Kbytes - no installation required). So here is a way to securely connect to the net using only an SSH client (PuTTY) and a remote cdrouter box that you control/trust.

Requirements:

1. PuTTY* loaded on your windows machine
2. Remote host running Linux LiveCD Router
3. Firefox or IE
4. Gaim
5. Email with Thunderbird

Just follow these steps…

1. Create a new PuTTY session
Run PuTTY and create a new session in PuTTY to connect to the remote host that is running OpenSSH. Fill in the hostname, the port (usually 22), make sure SSH is checked, give it a session name and hit Save:

2. Configure a secure tunnel
Click on “Tunnels” on the left and set up dynamic fowarding for a local port (e.g. 7070). Under “Add new forwarded port” type in 7070 for the source port, leave the destination blank, and check Auto and Dynamic. Then it the Add button. If you did it correctly, you’ll see D7070 listed in the Forwarded Ports box:

That’s it for tunnels, as there is no need to create more than one. Remember to save your session profile in PuTTY so you don’t have to set up the tunnel next time.

3. Connect to the remote SSH box
Double click on the connection profile and type in your username and password when prompted.

4. Configure Internet Explorer
Go to Tools, Connections, Lan Settings, and then click advanced and Proxy Settings…

5. Configure Firefox
Go to Tools, Options, General, and then click on Connection Settings…

Check Manual Proxy Configuration, leave most of the fields blank, but fill in 127.0.0.1 for the SOCKS v5 host with a port of 7070 (or whatever you used in Step 2):

6. Configure Gaim
Fire up Gaim and hit the Preferences button:

Then select Network on the left and set up the Proxy Server. The Proxy Type should be SOCKS 5. The host is 127.0.0.1 and the port is 7070 (or whatever you chose in Step 2).

There’s no need for a user or password. Then hit close.

7. Enjoy
That’s it. From now on, as long as you first log into the remote ssh host with PuTTY, your Internet Explorer, Firefox and IM traffic will be routed over a secure tunnel to the remote host and then out to the Net.

In general any application that can be configured for SOCKS port 7070 can be tunneled securely over putty/ssh. For example Email with Outlook, Thunderbird, some SIP softphones and more

---

More details and Comments

* Yes, PuTTY is available for Linux. It’s even in Portage!

Update (Email): Actually, the setup for Thunderbird to securely proxy your email traffic is pretty much the same as it is for Firefox.

And then type in 127.0.0.1 and your port number:

That’s it.

1. Note that this method will secure your connection between your remote location (e.g. WiFi hotspot) and the ssh host (e.g. Linux box at home). It is not secure from the ssh host to Internet. For the most part, that’s OK as it will provide reasonable protection from people running packet sniffers at the hotspot. But please recognize that if your ssh host is on your cable connection at home, your ISP can still (obviously) easily sniff all your packets.
2. Quite a few people have correctly pointed out that DNS queries will still be “leaked” to the untrusted network. So the names of any sites you visit will still get logged.

   Now if you don’t mind people knowing what sites your are connecting to, then there’s nothing to worry about. But if are running the current version of Firefox and would like to protect that information, you can open the about:config page, and change network.proxy.socks_remote_dns to true.

   You can do the same thing in Thunderbird if you would like.

   For a greater level of security on all your connections, you should consider running a full VPN (see also: IPCop + OpenVPN HOWTO).

3. As Nate pointed out in the comments, if you have the command-line version of OpenSSH already installed on your computer, you don’t need to mess with PuTTY. Just run ssh -D 7070 user@host.example.com and that will set up your tunnel. I’m not an Apple user, but I think OS X has everything you need.
4. There are portable versions of Firefox, Gaim, and Thunderbird, and PuTTY runs from a USB drive. So using this method (unlike using OpenVPN) there is no need to install anything on the computer you are using. Quite handy if you are borrowing someone’s computer or you are in a school computer lab.
5. How do you know if it’s working? Personally, I used SmartSniff to look at the packets and make sure they looked encrypted and were on the right ports. Of course, any packet sniffer would do.

   The other method (and I tried this one too) is to get all set up and running with the tunnels. And then after it is apparently working, kill PuTTY and see if you lose the connection.

   Of the two, the packet sniffer is the better way to go.

6. Apparently Opera only does SOCK4. I didn’t personally try it, but this should work with SOCKS4 proxies as well as SOCKS5.
7. SocksCap (non-commercial, home-use only) will let you run just about anything over a SOCKS5 proxy. Including Counterpath Eyebeam SIP Softphone - if configured for TCP transport instead of the default SIP UDP transport! SocksCAP HOWTO

What won't work through a PuTTY tunnel