[lug] WRT54GL is snarfing ssh port-forwarded HTTP traffic

Jed S. Baer blug at jbaer.cotse.net
Sun Jun 10 08:25:33 MDT 2012


On Sat, 09 Jun 2012 18:53:10 -0600
David L. Anselmi wrote:

> How is the WRT sending HTTP to A?  What ports on A and the WRT?  Who
> sent the SYN to set up the connection?

The SYN, etc, is all on 127.0.0.1. I tested again using just
$ telnet localhost 10101
while wireshark is pointed at lo.
The whole capture shows nothing other than between the port allocated
by telnet, and 10101.

But just now, I monitored eth0 on host B. And it appears that B is
reflecting the whole http session back out. And, the light dawns on me as
I'm typing.

ssh -L 10101:hostname:80 -p portnum user at hostname is wrong, should be
ssh -L 10101:localhost:80 -p portnum user at hostname

And, that works just fine.

Of course, this makes me realize that my WRT is at least partially
exposing its management interface on the internet side, and it'd be nice
to turn that off. A gander through the options there isn't showing me any
options I can disable that indicate such a thing.

Anyways, thanks for listening. :)

jed



More information about the LUG mailing list