Reverse proxy over ssh, is it any good?

Allan_Virtanen

I was thinking of hosting some sites on dedicated servers at home over a CG-NAT network then use a couple of VPS instances as front-end.

What would be the best way to setup a proxy? So far I've heard of SSH, where the client opens up a reverse connection. This sounds great in theory as the traffic in between will be encrypted but is it a viable solution?

Kenneth_Crayton

If you can keep the connection alive it should be sufficient for most needs. Try something like:

ssh -R 80:127.0.0.1:3000 user@server1

Where ´server1´ is your VPS instance, -R 80 means the listen port on your remote host (any available port should work) and 3000 at the end in this example is the listening port of your application on localhost.

The connection breaks when pressing CTRL + C, tho you could run it in the background with & > /dev/null in the end or probably better as a service which will restart the whole thing as soon as the connection drops, which occasionally happens every now and then with ssh.

You will also need to edit /etc/ssh/sshd_configon your VPS, and set GatewayPorts yes, it's no by default. This allows port forwarding.

Boris_Zaitseva

The -R flag is for remote tunneling, you can also use -L for local tunneling which is similar but likely more prone to fail if we're talking about this specific scenario. SSH also supports dynamic tunneling with -D, tho this is more relevant for regular proxy use, such as when you need to access restricted websites and similar.

James_Morgan

It should work, but don't forget about security. With this approach I suggest you do the security in the back end primary as the SSH connection will essentially act like a tunnel only.