Reverse proxy on Fornax

Before using these workarounds: If you need access to a specific website for your research, please file an issue at the group helpdesk so it can be added to the whitelist. The proxy methods below are temporary workarounds for legitimate blocked sites.

For anyone working on Fornax — since its internet is whitelisted and most HTTPS sites are blocked, here are two ways to tunnel out through an SSH connection to your own machine. Your laptop/desktop fetches the pages and passes them back to Fornax over the SSH cable you already have open. Nothing gets installed on Fornax itself.

Approach 1 — No install, just SSH

SSH can act as a proxy on its own.

1. Connect with a reverse SOCKS forward:

   ssh -R 1080 USERNAME@fornax.nus.edu.sg

2. On Fornax, set:

   export https_proxy=socks5h://127.0.0.1:1080
   export no_proxy=localhost,127.0.0.1

3. Test:

   curl https://pypi.org

• Works on any OS (Ubuntu/macOS/Windows), no software to add.
• Great for curl, git, pip.
• A few tools (apt, classic wget) don’t understand SOCKS — use Approach 2 for those.

Approach 2 — tinyproxy + SSH (one small install on your machine)

Gives you a full HTTP proxy, which every tool understands.

1. Install on your local machine (not Fornax):

   • Ubuntu: sudo apt install tinyproxy
   • macOS: brew install tinyproxy

2. Ensure the config has Port 8888 and Listen 127.0.0.1, then start it. On macOS, config lives at $(brew --prefix)/etc/tinyproxy/tinyproxy.conf and you can run it in the foreground to test:

   tinyproxy -d -c "$(brew --prefix)/etc/tinyproxy/tinyproxy.conf"

3. Connect, forwarding Fornax’s port 8888 back to your machine:

   ssh -R 8888:127.0.0.1:8888 USERNAME@fornax.nus.edu.sg

4. On Fornax, set:

   export https_proxy=http://127.0.0.1:8888
   export no_proxy=localhost,127.0.0.1

This works for apt, wget, pip, npm, conda, etc.

Which to use

• Want zero setup and only need curl/git/pip → Approach 1.
• Need apt/wget, or want everything to “just work” → Approach 2.

They can run side by side too, giving Fornax both a SOCKS and an HTTP proxy at once.

Make it permanent

Add to ~/.ssh/config under the Fornax block so a plain ssh fornax always brings the proxy up:

Host fornax
    HostName fornax.nus.edu.sg
    User USERNAME
    RemoteForward 1080
    ExitOnForwardFailure yes