SSH in the Browser: Wetty, Guacamole, SOCKS Proxies, and Port Forwarding for Firefox

Firefox's built-in SSH capabilities are zero — it's a browser, not an SSH client. But there are several ways to bring SSH functionality into your browser environment, and Firefox's security model affects how they work.

Browser-Based SSH Options

1. Secure Shell Extension (Chromebook default, works on Firefox)

Xterm.js + WebSockets: Most browser SSH clients use xterm.js (a terminal emulator in JavaScript) connected to a WebSocket that proxies SSH.

Common implementations:

• Apache Guacamole: Full remote desktop + SSH proxy. Self-hosted.
• Wetty: Web-based SSH terminal using xterm.js. Run on your server, access from any browser.
• Shell in a Box: Older but similar concept.
• GateOne: Another browser-based SSH client.

2. Wetty Setup Example

Wetty runs Node.js on your server and provides a browser-based SSH terminal:

# Install Wetty (on your server)
npm install -g wetty

# Run Wetty on port 3000, SSH to local machine
wetty --port 3000 --ssh-host localhost --ssh-port 22 --base /ssh

# With SSL (recommended for security)
wetty --port 443 --ssl-key /path/to/key.pem --ssl-cert /path/to/cert.pem

Access in Firefox: Navigate to https://yourserver.com:3000/ssh/ → full xterm.js terminal.

Security consideration: Never run Wetty without SSL. The SSH credentials are sent from browser to Wetty server over HTTP without SSL.

3. Apache Guacamole

More complete than Wetty — supports SSH, VNC, RDP from the browser:

# Docker setup
docker run --name guacamole \
  -e POSTGRES_DATABASE=guacamole_db \
  -e POSTGRES_USER=guacamole_user \
  -e POSTGRES_PASSWORD=password \
  -e GUACAMOLE_HOME=/etc/guacamole \
  -p 8080:8080 \
  guacamole/guacamole

After setup, access http://yourserver:8080/guacamole/ → create SSH connections → access from Firefox.

Firefox-Specific Security Considerations

HTTP vs HTTPS: Firefox enforces strict security for WebSockets over HTTP:

• ws:// (unencrypted WebSocket) from HTTPS pages is blocked
• Your Wetty/Guacamole instance must use HTTPS if accessed from an HTTPS context

Connection security: When connecting to a browser SSH client, ensure:

1. The connection to the proxy is over HTTPS
2. The proxy server is trusted
3. The SSH server's host key is verified (browser SSH clients often skip this)

Host key verification: Most browser SSH clients ask you to verify the server fingerprint on first connection. Don't skip this — it's the equivalent of SSH's "Are you sure you want to continue connecting?" prompt.

Firefox and WebSSH2

WebSSH2 is another option:

git clone https://github.com/billchurch/webssh2.git
cd webssh2
npm install
node app/index.js

# Access at http://localhost:2222/?port=22&hostname=yourserver

This creates a browser-accessible SSH terminal. With HTTPS and authentication, it's a usable admin tool.

SSH Tunneling for Firefox

Even without browser SSH, SSH tunneling is useful for Firefox:

SOCKS Proxy via SSH

# Create a SOCKS5 proxy on localhost:8080 via SSH tunnel
ssh -D 8080 -N -q -C [e-mail]

Then configure Firefox:
Settings → Network → Proxy Settings → Manual proxy → SOCKS5: 127.0.0.1:8080

Use case: Route Firefox traffic through a remote server (access geo-blocked content, bypass corporate filtering, add a layer of anonymity).

SOCKS5 with DNS: In Firefox proxy settings, check "Proxy DNS when using SOCKS5" — this routes DNS queries through the proxy too, preventing DNS leaks.

Port Forwarding for Local Services

# Forward remote port 8080 to local 8080
ssh -L 8080:localhost:8080 [e-mail]

Then access http://localhost:8080 in Firefox to reach the remote service.

Use case: Access internal web services, admin panels, or development servers on remote machines — directly in Firefox without VPN.

Reverse Tunneling for Remote Access

# On remote machine: forward its port 22 to your local machine's port 2222
ssh -R 2222:localhost:22 [e-mail]

Then from your machine:

ssh -p 2222 user@localhost

This allows accessing a machine behind NAT or firewall without port forwarding. Useful when the remote machine can only initiate outbound connections.

Firefox and Jump Boxes

When your SSH workflow involves jump boxes (bastion hosts):

# SSH config for jumping through a bastion
Host internal-server
    HostName 10.0.0.100
    ProxyJump bastion.example.com
    User yourname

For browser-based SSH (Wetty, Guacamole) on a jump box, the proxy server itself needs to handle the SSH jump configuration. This is done in the Guacamole or Wetty server configuration, not in Firefox.

Firefox Extensions for SSH-Adjacent Work

No SSH extensions for Firefox exist in the same way as Chrome has "Secure Shell" — Firefox's extension API doesn't provide raw TCP socket access needed for a direct SSH client.

What does exist:

• SSH Agent extensions: None that work well (no system socket access)
• Terminal emulators: Some can emulate basic terminals but not SSH directly

For SSH from the browser, the WebSocket proxy approach is the practical solution.

Local Development with Firefox + SSH

A common developer workflow:

1. SSH to a remote dev server
2. Run a development server on port 3000 on the remote machine
3. SSH port forward to local: ssh -L 3000:localhost:3000 user@devserver
4. Firefox accesses http://localhost:3000 — actually viewing the remote dev server

This is seamless and doesn't require any Firefox configuration beyond pointing it at localhost.

Summary

Approach	What It Provides	Firefox Configuration Needed
Wetty / WebSSH2	Full SSH terminal in browser	None (just navigate to URL)
Guacamole	SSH + VNC + RDP in browser	None
SSH SOCKS proxy	Route Firefox through SSH tunnel	Settings → Proxy → SOCKS5
SSH port forward	Access remote services locally	Point Firefox at localhost port

Firefox doesn't do SSH natively, but it works seamlessly with all the proxy/tunnel approaches that make browser-based SSH practical for server administration.