linux routing outbound port 80 traffic via ssh tunnel, iptables, or a simple route

Question

I have two hosts, A and B. Host A hosts services on port 8080 and has outbound internet firewall rules allowing port 80 and 443 access to Host C.

Host B is on the same subnet as Host A. Host B is blocked from reaching internet Host C. Host A, however, has outbound rules on an external firewall that allows port 80 and 443 outbound to Host C.

Host B runs a software client with hardcoded URLS to download from Host A (http port 8080), and Host C (http port 80). Again, Host B is blocked from reaching Host C via firewall. The client on Host B does not support SOCKS or any other proxy capability. The only way I can possibly reach Host C:80 is by redirecting or tunneling via Host A.

I have root access to Host A and Host B. How can Host B reach Host C via Host A on port 80?

Why does this not work on host B?

ssh -L 80:hostC:80 root@hostA -N

I've enabled AllowTCPForwarding and GatewayPorts on Host A. Is right for this or is there an iptables trick that I can use?

This image is a diagram of want to do with what I have: http://i.imgur.com/rOhQ9Us.png

Answer 1

As @Nathan Adams said, a picture would be particularly useful in solving this problem. I've not come across what you are trying to do before, but after creating a diagram for myself and reading up on the -L command for SSH, I suspect the problem is that you need to run it as root, as the port you are trying to bind is a privileged port (ie < 1025).

Answer 2

Where is the firewall, on B itself or external?

Your ssh command isn't working because it binds port 80 on B to forward to C through A. From your description, you have a hardcoded address, which means B isn't trying to connect to port 80 on itself. The hardcoded address is key to your problem. Does the URL contain a logical address, or an actual hardcoded IP address?

If the firewall is on B, you'd have to avoid having packets go out addressed to C. I assume this isn't the case, since you have root on B. However, a solution in this case also should work no matter what, namely find a way to get connections to C to go to A instead. You might be able to do this by manipulating DNS, or with a firewall rewrite rule.

Another trick would be to have A as your default route for B. Assuming C is external and will hit the firewall when trying to return packets to B, you'd want to have A do NAT for B. A really crude approach is to have A respond to ARP requests to trick traffic into going through it, but that is unlikely to be viable except in very small setups.

Answer 3

Saw this looking for something else, but thought I'd answer even though it's old:

On Host B:

ssh -L 8080:hostC:80 user@hostA -N -f
sudo iptables -t nat -A OUTPUT -d hostC -p tcp --dport 80 -j DNAT --to 127.0.0.1:8080

The software on Host B is hardcoded to connect to HostC:80 (per the question), so you must redirect the connection to go through the SSH tunnel you created. Also with the above changes, you shouldn't need to run anything as root.