Socks SSH forward internet and DNS
https://datawookie.dev/blog/2023/12/ssh-tunnel-dynamic-port-forwarding/

# local
ssh -R 1080 user@remote

# remote
export http_proxy=socks5h://localhost:1080
export https_proxy=socks5h://localhost:1080
# export HTTPS_PROXY=socks5://localhost:1080/

#echo "nameserver 127.0.0.1" > /etc/resolv.conf

cat < /etc/apt/apt.conf.d/12proxy
Acquire::http::Proxy "socks5h://localhost:1080";
Acquire::https::Proxy "socks5h://localhost:1080";
EOF

cat <> /etc/environment
#export http_proxy=socks5h://localhost:1080
#export https_proxy=socks5h://localhost:1080
export all_proxy=socks5h://localhost:1080
EOF


# Configurte scks5h proxy in Docker
mkdir /etc/systemd/system/docker.service.d
cat < /etc/systemd/system/docker.service.d/proxy.conf
[Service]
Environment="HTTP_PROXY=socks5h://127.0.0.1:1080"
Environment="HTTPS_PROXY=socks5h://127.0.0.1:1080"
EOF
sudo systemctl daemon-reload
sudo systemctl restart docker docker.service


# python
sudo apt install -y python3-socks

# git
git config --global http.proxy 'socks5h://127.0.0.1:1080'


# SSH config
Host my-remote
    HostName my_server.com
    RemoteForward 1080
    ServerAliveInterval 60
    ServerAliveCountMax 3


or optional
# dns2socks
# http(s) / socks export
# https://lib.rs/install/dns2socks
https://gist.github.com/yougg/5d2b3353fc5e197a0917aae0b3287d64

# dns2socks
wget https://github.com/tun2proxy/dns2socks/releases/download/v0.2.0/dns2socks-x86_64-unknown-linux-gnu.zip
dns2socks --socks5-settings socks5://localhost:1080 --force-tcp

sudo apt install dropbear-initramfs

sudo sed -i 's/#DROPBEAR_OPTIONS=/DROPBEAR_OPTIONS="-I 180 -j -k -p 4000 -s -c cryptroot-unlock"/g' /etc/dropbear/initramfs/dropbear.conf

# optional: configure IP if no DHCP avaiable
# echo 'IP=192.168.2.123::192.168.2.1:255.255.254.0:my-wks01' >> /etc/initramfs-tools/initramfs.conf

sudo ssh-import-id gh: -o /etc/dropbear/initramfs/authorized_keys

sudo update-initramfs -u

ssh root@your_workstation_ip -p 4444

# unlock disk
unlock-cryptroot

Links
https://www.cyberciti.biz/security/how-to-unlock-luks-using-dropbear-ssh-keys-remotely-in-linux/
https://realtechtalk.com/Howto_Set_Static_IP_on_boot_in_initramfs_for_dropbear_or_other_purposes_NFS_Linux_Debian_Ubuntu_CentOS-2278-articles

@Office

cat < ~/bin/proxy-ssh-forward.sh
#!/bin/bash

PROXY_SERVER=proxy.example.com

eval \$(ssh-agent) && ssh-add

while true; do
    echo "Connect to proxy ..."
    ssh -a -v -N -R 7422:localhost:22 -o ServerAliveInterval=30 -o ServerAliveCountMax=10 \${PROXY_SERVER}
    sleep 10
done
EOF

chmod +x ~/bin/proxy-ssh-forward.sh
nohup ~/bin/proxy-ssh-forward.sh

@Home

cat <> ~/.ssh/config.d/office
Host proxy.example.com
Hostname 1.2.3.4
User foo

Host proxy-ssh-office
Hostname 127.0.0.1
Port 7422
User bar
#ForwardAgent yes
ProxyCommand ssh proxy.example.com -W %h:%p
EOF

ssh proxy-ssh-office

# forward DNS
cat <> ~/bin/vpn-mr-proxy.sh
#!/bin/bash

/usr/bin/sshuttle \
  --dns \
  192.168.1.0/24 \
  --exclude 192.168.178.0/24 \
  --remote proxy-ssh-office
EOF

Allow SSH access

LB_ID=foo-lb01-prod

AMPHORA_ID=$(openstack loadbalancer amphora list --loadbalancer ${LB_ID} --role MASTER -c id -f value)
AMPHORA_COMPUTE_ID=$(openstack loadbalancer amphora show ${AMPHORA_ID} -c compute_id -f value)
LB_NETWORK_IP=$(openstack loadbalancer amphora show ${AMPHORA_ID} -c lb_network_ip -f value)
SECURITY_GROUP_ID=$(openstack port list --server ${AMPHORA_COMPUTE_ID} --fixed-ip "ip-address=${LB_NETWORK_IP}" -c security_group_ids -f value)

# DEBUG: show ingress tcp rules
openstack security group rule list --ingress --protocol tcp ${SECURITY_GROUP_ID}
openstack security group rule create --protocol tcp --dst-port 22:22 --remote-ip 172.16.0.0/12  ${SECURITY_GROUP_ID}
openstack loadbalancer amphora list --loadbalancer ${LB_ID} -c  lb_network_ip -c role -f value
openstack loadbalancer amphora list --loadbalancer ${LB_ID} -c  lb_network_ip --role MASTER -f value

# login to amphora VM from OpenStack control node
ssh local@ctl1-dev.dev.i.example.com
ssh -i ~/.ssh/id_rsa_octavia ubuntu@${AMPHORA_VM_IP}

Manuall SSH access

export CONTAINER=vpn

# create container
# TODO: configure MAC on create container
wget -q --no-check-certificate https://raw.githubusercontent.com/panticz/lxc/master/create.jessie.sh -O - | bash -s -- -f

# configure container MAC address
sed -i 's|lxc.network.hwaddr = .*|lxc.network.hwaddr = 00:11:22:33:44:5e|' /var/lib/lxc/${CONTAINER}/config

# enable autostart
echo "lxc.start.auto = 1" | tee -a /var/lib/lxc/${CONTAINER}/config

# configure container
##echo "lxc.hook.autodev=/var/lib/lxc/vpn/autodev" >> /var/lib/lxc/${CONTAINER}/config
#echo "lxc.cgroup.devices.allow = c 10:200 rwm" >> /var/lib/lxc/${CONTAINER}/config

# do we need this outside of container?
#cat < /var/lib/lxc/${CONTAINER}/autodev 
##!/bin/bash

# dep
#cd \${LXC_ROOTFS_MOUNT}/dev
#mkdir net
#mknod net/tun c 10 200
#chmod 0666 net/tun
#EOF
#chmod +x /var/lib/lxc/${CONTAINER}/autodev

# configure SSH access
# generating SSH key for root
sudo lxc-attach -n ${CONTAINER} -- ssh-keygen -q -f /root/.ssh/id_rsa -N ''

# disable SSH password login
sudo lxc-attach -n ${CONTAINER} -- sed -i 's|[#]*PasswordAuthentication yes|PasswordAuthentication no|g' /etc/ssh/sshd_config
sudo lxc-attach -n ${CONTAINER} -- sed -i 's|UsePAM yes|UsePAM no|g' /etc/ssh/sshd_config
sudo lxc-attach -n ${CONTAINER} -- service ssh restart

# configure SSH server
echo "PermitTunnel yes" >> /var/lib/lxc/${CONTAINER}/rootfs/etc/ssh/sshd_config
# do we need this?
###sed -i 's|#   Tunnel no|    Tunnel no|' /var/lib/lxc/${CONTAINER}/rootfs/etc/ssh/ssh_config
sed -i 's|#   TunnelDevice any:any|    TunnelDevice any:any|' /var/lib/lxc/${CONTAINER}/rootfs/etc/ssh/ssh_config
#sudo lxc-attach -n ${CONTAINER} -- service ssh restart

# enable forwarding
sed -i 's|#net.ipv4.ip_forward=1|net.ipv4.ip_forward=1|' /var/lib/lxc/${CONTAINER}/rootfs/etc/sysctl.conf
# echo "1" > /proc/sys/net/ipv4/ip_forward

# load iptables module (on LXC host)
sudo echo 'ip_tables' >> /etc/modules