{"id":255499,"date":"2016-04-20T14:31:01","date_gmt":"2016-04-20T06:31:01","guid":{"rendered":"http:\/\/blog.zhenglei.net\/?p=255499"},"modified":"2016-04-20T14:35:43","modified_gmt":"2016-04-20T06:35:43","slug":"road-warrior-ssh-share-port-443","status":"publish","type":"post","link":"https:\/\/blog.zhenglei.net\/?p=255499","title":{"rendered":"road warrior & ssh share port 443"},"content":{"rendered":"

With help of SNI in stunnel,\u00a0 we can\u00a0 support both\u00a0 road warrior and ssh function on the same TCP\/443 port.<\/p>\n

 <\/p>\n

VPS Server:<\/strong><\/span><\/p>\n

Install\u00a0 stunnel v5.31 with\u00a0 openssl\u00a0 v1.0.2, and listen on port 443<\/p>\n

Install dante v1.4.1,\u00a0 and listen on port 1080<\/p>\n

Install openssh, and listen on port 22<\/p>\n

 <\/p>\n

Stunnel config for VPS server<\/strong><\/span><\/p>\n

chroot = \/var\/lib\/stunnel\/
\npid=\/stunnel.pid
\nsetuid = stunnel
\nsetgid = stunnel<\/em><\/p>\n

;debug =debug
\ndebug = err
\n;foreground = yes<\/p>\n

log = append
\n;log = overwrite
\noutput = \/stunnel.log<\/p>\n

cert = \/etc\/stunnel\/stunnel.pem
\n;key = \/etc\/stunnel\/stunnel.pem<\/p>\n

verify = 3
\nCApath = \/certs<\/p>\n

; performance
\nsocket = l:TCP_NODELAY=1<\/p>\n

;compression = deflate
\ncompression = zlib<\/p>\n

[tls]
\naccept = 0.0.0.0:443
\nconnect = 127.0.0.1:1080<\/p>\n

[ssh]
\nsni = tls:22.vps.server.net
\nconnect = 127.0.0.1:22<\/p>\n

[socks]
\nsni = tls:vps.server.net
\nconnect = 127.0.0.1:1080<\/p>\n

 <\/p>\n

stunnel listen on 22 for ssh connection<\/p>\n

stunnel listen on 1080 for socks connection<\/p>\n

 <\/p>\n

Stunnel config for client within Corp’s network:<\/strong><\/span><\/p>\n

chroot = \/var\/lib\/stunnel\/<\/em>
\n pid=\/stunnel.pid<\/em>
\n setuid = stunnel<\/em>
\n setgid = stunnel<\/em><\/p>\n

;debug = alert\/crit\/err\/warning\/notice\/info\/debug<\/em>
\n debug = err<\/em><\/p>\n

;foreground = yes<\/em><\/p>\n

cert = \/etc\/stunnel\/stunnel.pem<\/em><\/p>\n

;compression = deflate | zlib<\/em>
\n compression = zlib<\/em><\/p>\n

client = yes<\/em><\/p>\n

; performance<\/em>
\n socket = l:TCP_NODELAY=1<\/em><\/p>\n

[socks-http-proxy]<\/em>
\n accept = 127.0.0.1:1080<\/em>
\n connect = http_proxy_ip:http_proxy_port<\/em><\/p>\n

protocol = connect<\/em>
\n protocolHost = vps.server.net:443<\/em><\/p>\n

[ssh-http-proxy]<\/em>
\n accept = 0.0.0.0:22<\/em>
\n connect = http_proxy_ip:http_proxy_port<\/em>
\n protocol = connect<\/em>
\n protocolHost = vps.server.net:443<\/em>
\n sni = 22.vps.server.net<\/em><\/p>\n

 <\/p>\n

 <\/p>\n

How to<\/strong><\/p>\n

Road Warrier:\u00a0<\/span> <\/strong><\/p>\n

set socks proxy of browser to 127.0.0.1:1080<\/p>\n

 <\/p>\n

SSH to vps.server.net<\/span><\/strong><\/p>\n

ssh -p 22\u00a0 user@localhost<\/p>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

With help of SNI in stunnel,\u00a0 we can\u00a0 su … \u7ee7\u7eed\u9605\u8bfb →<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6,9],"tags":[287,288,283,279],"class_list":["post-255499","post","type-post","status-publish","format-standard","hentry","category-internet","category-vps","tag-dante","tag-road-warrier","tag-sni","tag-stunnel"],"_links":{"self":[{"href":"https:\/\/blog.zhenglei.net\/index.php?rest_route=\/wp\/v2\/posts\/255499","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.zhenglei.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.zhenglei.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.zhenglei.net\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.zhenglei.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=255499"}],"version-history":[{"count":3,"href":"https:\/\/blog.zhenglei.net\/index.php?rest_route=\/wp\/v2\/posts\/255499\/revisions"}],"predecessor-version":[{"id":255502,"href":"https:\/\/blog.zhenglei.net\/index.php?rest_route=\/wp\/v2\/posts\/255499\/revisions\/255502"}],"wp:attachment":[{"href":"https:\/\/blog.zhenglei.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=255499"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.zhenglei.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=255499"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.zhenglei.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=255499"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}