HTTP proxies might also be an alternative.
While we currently leans towards HTTP proxies, there are arguments for SOCKS as well. For example, ssh actually has built-in socks server support. There's also some discussions on the VNC list about adding SOCKS support to TigerVNC.
OpenSSH does support SOCKS proxies nowadays. See for instance http://www.debian-administration.org/articles/449
See also: bug 3003.
There are two main ways of doing this, either by having some ThinLinc specific gateway (like Microsoft and Citrix does things), or by having a more standardised reverse proxy (using something like bug 500). The problem with the second approach is how to configure clients. Manually pushing configuration to all clients doesn't really scale well. And you don't want to force users to reconfigure their proxy settings when switching servers. One idea on how to deploy this is TXT records. Look at DNS-SD for an example of how they can be used to effectively convey out of band details. The big question is how feasible it is for administrators to configure their DNS zones in this way.
https://community.thinlinc.com/t/jumphost-support/275
https://community.thinlinc.com/t/another-tunneling-question/402/3
*** Bug 4358 has been marked as a duplicate of this bug. ***
(In reply to Pierre Ossman from comment #7) > There are two main ways of doing this, either by having some ThinLinc > specific gateway (like Microsoft and Citrix does things), ... For reference, Microsoft's product for this is called "RD Gateway". It is often touted as a security improvement, but it doesn't improve much in the way of security, as it uses the same authentication methods as the RDP server. It is fewer machines to keep fully updated, though. It tunnels RDP over HTTPS, which should make it more friendly for more complex network setups. Unclear exactly what HTTP mechanism it uses, though. It is old, so likely not WebSockets. Microsoft has not solved the user side of things well. Their client can either get a single setting from GPO, or the user can manually enter a single value. This means it is annoying for users connected to different sites. Their client at least has the option of caching the credentials used for the gateway for reuse to the RDP server.
