Tails OS - Unable to create ssh tunnel with port forwarding over tor

Question

I am using Tails live OS and i am trying to create ssh tunnel to remote server and forward Tor browser through this tunnel. I am creating the tunnel with this command:

ssh -i keyfile user@xx-xx-xx-xx -D 9999

SSH is configured to use Tor by default so the ssh tunnel is created over Tor.

Then in Tor browser proxy configuration i am changing the port from 9150 to 9999. The proxy type is Socks5 and the host is 127.0.0.1.

But when i try to load webpage the browser display error message: "the proxy server is refusing connections".

The ssh command is correct, in verbose mode it doesn't display any errors when connecting to the server. The browser proxy configuration settings are also correct.

How to find what is blocking the port forwarding? How to troubleshoot the problem?

Answer 1

open up two terminal tabs. in the first tab:

run the following to view the system log. this is a good rule of thumb when trying to troubleshoot.

sudo tail -f /var/log/syslog

in the second tab:

try to connect to your ssh server using your command and configure your browser to use a SOCKS5 proxy at 127.0.0.1:9999. you should see from the syslog that the traffic is getting dropped.

the firewall rules in TAILS are built using ferm, and the policy is defined in /etc/ferm/ferm.conf. to punch a hole in the firewall for your desired port, run this:

sudo sed -i 's/(9050 9061 9062 9150)/(9050 9061 9062 9150 9999)/g' /etc/ferm/ferm.conf

essentially we're allowing traffic at port 9999. now, reload ferm with:

sudo /usr/sbin/ferm /etc/ferm/ferm.conf

re-connect to your ssh server and you should see that your traffic no longer gets dropped.

other considerations

i also recommend you add the following options to your ssh command:

-o ExitOnForwardFailure=yes ServerAliveInterval=120 

these essentially do what they look like.

also, the changes to the firewall are temporary, and will be lost on reboot. however, it would be prudent to close the port once you've ended your ssh session. to do this, execute:

sudo sed -i 's/(9050 9061 9062 9150 9999)/(9050 9061 9062 9150)/g' /etc/ferm/ferm.conf
/usr/sbin/ferm /etc/ferm/ferm.conf 

writing a shell script to automate this will make it less tedious. if you go this route, you should code the firewall reset commands using an exit trap:

http://redsymbol.net/articles/bash-exit-traps/

tails relevant linkies:

https://tails.boum.org/contribute/design/Tor_enforcement/Network_filter/

https://git-tails.immerda.ch/tails/plain/config/chroot_local-includes/etc/ferm/ferm.conf