How can I create a proxy tunnel from a network that has all ports but port 80 closed? I guess I'd have to bind SSH on my server to port 80, but would that introduce problems to my home network since routers interface is on port 80?

Would TOR be a better solution for something like this?

5 Answers 5


I often use Tor for this kind of tunneling. If Tor works in your network environment, set up a hidden service. The directory /var/lib/tor (GNU/Linux) has a subdirectory for your hidden service. Inside is a file called hostname. You add a section in you .ssh/config:

Host *.onion
  ProxyCommand socat STDIO SOCKS4A:,socksport=9050

plus maybe other options. Now you can connect to your machine using ssh hidden-service-hostname.onion and no firewall will stop you.


It's actually very easy to create a single port tunnel to take advantage of whatever port is open on a router. This happens a lot in security testing - maybe I can take advantage on a vulnerability on a server, but I then want to do something useful with it such as escalate the attack further. What I then usually do is run netcat to create an outgoing channel (say on port 80 which looks to a router or firewall just like web traffic.)

It shouldn't matter that your router command port is port 80 - that is only relevant if you wish to connect to the router, but in terms of routing through the router this solution should do what you need.

Quick follow up as my comment on Shewfig's is possibly not very clear:

You can run any service on any port (pretty much) so running an encrypted service such as SSH on port 80 is fine. It will not open you up to attacks on html as you aren't running an html server on this port. There is also a big difference between outbound ports open and inbound. If you have port 80 open outbound, the router/firewall will typically allow replies on a high port (ie not port 80)

  • so if I understand corectly - with netcat I can go out with SSH from the local network on port 80, and connect to for example my home router that has port 22 set for SSH?
    – tkit
    Dec 9, 2010 at 22:12
  • 1
    Not quite - you are effectively using netcat (or other proxy) to make an ssh connection out to a server listening on port 80, so you will either need to enable port 80 through your home router to SSH listening on port 80, or you set up your router to swap ports on the way in. I know my ISP provided router does this - it will happily NAT and alter ports as configured. This shouldn't be a problem as your home router config listener should only be on the inside.
    – Rory Alsop
    Dec 9, 2010 at 22:49

There is an old but still partially relevant document called the firewall piercing howto. It is aimed at students who use Linux and find themselves trapped at some internship places behind a restrictive firewall which prevents them from slacking with the help of their favourite network-enhanced tools. On a general basis, I do not condone circumventing security features; but this is interesting reading (if somewhat obsolescent) if you want to understand network issues.


You could probably set up port forwarding, e.g. for a specific hostname/path, and have only those packets sent over to the other machine to be detunnelled. But this would depend very much on your router.

Just an additional comment re TOR - please take into account that while TOR might be invaluable for anonymoziation, it actually greatly harms your confidentiallity. So depending on what you're tunneling, you probably don't want any TOR node (and let's face it, most of them by now are malicious) viewing and altering your data.

  • any routers you know of that could pull this off?
    – tkit
    Nov 13, 2010 at 9:49
  • Sorry, I'm an appsec guy, don't play with routers too much anymore... :). But I have seen something like this in the past, probably with the higher-end / enterprise-level routers...
    – AviD
    Nov 13, 2010 at 16:07
  • ok, thanks anyway. :) and about TOR - I agree, and I guess it would probably be a good idea to make an ssh tunnel through TOR then heh :D
    – tkit
    Nov 14, 2010 at 8:58
  • @pootzko, what about a subdomain?
    – AviD
    Nov 14, 2010 at 12:47
  • @AviD - I use DynDNS for connecting to my home server, so it kinda already is a subdomain, if that's what you meant..
    – tkit
    Nov 15, 2010 at 14:58

The answer really depends on what you're really trying to accomplish.

If you're trying to create a generic proxy connection to your home network from inside this hypothetical "80 outbound only" network, then there are 2 things wrong: 1) SSL typically is hosted on 443: 80 is typically non-encrypted. Allowing only port 80 outbound guarantees that surfing from that network will get you pwned. 2) Your home router is listening to the internet on port 80, which will get it pwned.

If you're trying to create a proxy from the "80 only" network to browse the web from a different IP address, there are lots of public proxies for this already.

If you're trying to access your home PC from the "80 only" network, there are solutions like GoToMyPC and LogMeIn which do this by mediating the connection.

As a generic answer, I'd say that you should config your home router to stop listening itself on port 80 (turn off cleartext http, SSL only), then port forward 80 to 22 on your home server. Bonus points for configuring iptables on your home server to do port forwarding from 80 to 22 if browsed from the "80 only" network, and to stay on 80 for all other networks.

  • 1
    Shewfig - 2 mistakes here: 1 You say port 80 is unencrypted - but if you run ssh on port 80 it is encrypted. It is the service that is important, not the port. 2 the router does not need to listen to port 80 on the outside for this to work.
    – Rory Alsop
    Dec 9, 2010 at 20:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.