How do I know if my ssh tunnel is created successfully?

Question

I rely on the following script tunnel.sh written by others to keep a ssh tunnel alive:

#!/bin/bash
export SSH_HOST=tim@server 

if [ ! -f /tmp/.tunnel ] 
then
echo "Creat SSH tunnel"
ssh -f -D 9999 $SSH_HOST "if [ -f ~/.tunnel ]; then rm ~/.tunnel; fi; while [ ! -f ~/.tunnel ]; do echo > /dev/null; done" & 
touch /tmp/.tunnel 
else
echo "Close SSH tunnel"
ssh $SSH_HOST "touch ~/.tunnel" 
rm /tmp/.tunnel 
fi
exit

To create a persistent ssh tunnel, I just issue tunnel.sh. The tunnel will not be closed until I issue tunnel.sh again.

I was wondering how I can verify if the ssh tunnel is indeed created successfully?

My main use of the tunnel is to print documents to some printers in the same LAN as the server, and the printers can only be accessed from within the LAN. After creating a tunnel, now printing doesn't report any problem, but since I am not physically there, I cannot check if the documents have been indeed printed.

I thought since I am now in the LAN thanks to the tunnel, my external IP should be the same as the server's. But actually they are not the same (I found them out by wget -q -O - checkip.dyndns.org|sed -e 's/.*Current IP Address: //' -e 's/<.*$//'). I wonder why? When I connect to some website on the internet with the tunnel alive, isn't the server the midpoint between me and the internet website in the connection, due to the tunnel between me and the server?

Answer 1

That's a lot more complicated than it needs to be :-)

Start the tunnel:

ssh -f -N -D 9999 -M -S /tmp/ssh_tunnel_%h.sock -o ExitOnForwardFailure=yes $SSH_HOST && \
echo "ssh tunnel started successfully" || \
echo "ssh tunnel failed to start"

Stop the tunnel:

ssh -S /tmp/ssh_tunnel_%h.sock -O exit $SSH_HOST

.

That's all you need to do. If you want the details, skip below.

For your second question, the IP one. No, your IP does not change. All you did was to create a SOCKS proxy through the remote host. Your system does not automatically use this proxy unless you tell it to.

SSH explanation
Args for starting the tunnel:
-f: Tell ssh to background itself. It will only background itself if it starts up successfully (cooperates with the -o argument below).
-o ExitOnForwardFailure=yes: This tells ssh to exit if it can't set up the SOCKS proxy.
-N: Don't execute a command. We just want to tunnel, not do anything on the remote host.
-D 9999: Your SOCKS proxy.
-M: This is required for the -S argument to work here.
-S /tmp/ssh_tunnel_%h.sock: This tells it to use /tmp/ssh_tunnel_HOSTNAME.sock for its control socket. The -M option tells it that ssh needs to set this socket up and not issue commands to another ssh already listening on the socket. You can use this socket to set up additional tunnels after the ssh is already running. The %h uses the hostname of the remote host as part of the filename.

Args for stopping the tunnel:
-S /tmp/ssh_tunnel_%h.sock: This should be obvious. However since we didn't issue a -M, that means ssh should connect to the socket that's already there and tell it what to do rather than doing anything itself.
-O exit: This is part of the -S. We tell the ssh listening on the socket to exit.
The $SSH_HOST is still required here. Even if you were to specify an absolute socket path, without using %h in the filename, ssh would still want a remote host to be specified. This is why I put the %h in the arguments. Might as well use it if ssh is going to ask for the host, and it keeps things organized.

Answer 2

This type of tunnel doesn't change your ip address information. All it does is tell your computer to open up port 9999, and forward connections to that port to the remote machine (tim@server) via your ssh connection. The easiest way to test that the connection is up, is to telnet to the port the forward has been created on (in your example 9999):

$ telnet localhost 9999
Trying server...
Connected to server.
Escape character is '^]'.

If you receive the "Connected to server." message, that means your tunnel is up. If, instead you get: "Unable to connect to remote host: Connection refused" your tunnel is not up.

As to your second question, for your browser, your browser will not use the tunnel, unless you tell it to. In the browsers network settings, you can configure proxy settings, and specify localhost:9999 as a socks5 proxy and then your web connections should use the ssh tunnel and appear to come from the server's IP address.

Answer 3

In my case (Google Chrome on Ubuntu 14.10), my external address does change, at least within the browser. Just google "What's my IP address?" with and without the proxy connection.

Also, after you set up the proxy, try destroying the tunnel and see if you can still get traffic. When I do this, chrome returns an error "Unable to connect to the proxy server".

Another way: after tunneling to the remote host, create a new ssh session and run tcpdump -A dst port 80. Then browse to some page and you should see the related traffic in the terminal.

Answer 4

This is the best solution:

#!/bin/bash
export SSH_HOST=
export SSH_PORT=

if ps -lef | grep ssh | grep $SSH_PORT
then
echo "Starting SSH tunnel"
ssh -f -N -D $SSH_PORT -M -S /tmp/ssh_tunnel_%h.sock -o ExitOnForwardFailure=yes $SSH_HOST && \
echo "ssh tunnel started successfully" || \
echo "ssh tunnel failed to start"
else
echo "Stopping SSH tunnel"
ssh -S /tmp/ssh_tunnel_%h.sock -O exit $SSH_HOST
fi
exit

It checks if the tunnel is running and turns it on or off.