I want to copy files from a remote computer (W) to a private host computer (P) via scp. Since i can't connect to machine W directly i use an ssh tunnel over 2 different machines with port 22. What i would like to do, is to log into machine W and from there do an scp file transfer to machine P, the problem is that P is hidden in an network so i cant specify a remote host ip when i am logged into machine W. Is there a solution for this ?? I manage to do this when i am logged into machine P, but i dont want to remember the file path each time i copy a file.
2 Answers
After clarifying your setup as discussed above, your system looks like this:
P -- R -- M1 -- M2 -- W
R
is a NAT router that only allows connections from P
to M1
, but not the other way around and all nodes must be used in order to establish a connection.
Solution 1
Your only real problem is the router R
over which you have no control, so you must somehow establish a tunnel to allow W
to connect back. The simplest solution would be to have P
establish an SSH connection to M1
and establish a reverse port forward there.
You can then set up a second SSH tunnel from W
to M2
to forward local packets to the reverse port forwarded port on M1
, which can in turn be used to establish a tunneled SSH connection from W
to P
.
Solution 2
Now this adds quite some complexity to the whole setup, which makes it quite error prone. A better solution would be to establish a VPN connection between W
and M1
, P
and M2
and between M1
and M2
. Then you could establish a routing using a private address range from W
to P
over these three tunnels. For this to work you need root access to both M1
and M2
AND you need to set up proper firewalls so nobody from the outside gets into your VPN's.
There are of course other solutions as well, but what you need to think through how the packets are going to get through all these blockades, the actual solution can then be tailored to fit your tools.
-
Thank you for your reply, i managed to get Solution 1 to work, Solution 2 drops out since i don't have root access. I now can login from
W
toP
withssh -l userame -p 2210 localhost
. Just one question left is, how exactly do i use scp i.e. pass the username the port etc, i didn't managed to get this to work ? I tried something likescp parameter.ini -p 2210 username@localhost:~/parameter2.ini
after three password attempts i get the following messagePermission denied (publickey,keyboard-interactive). lost connection
– jruebsamMay 23, 2013 at 11:04 -
1@jruebsam:
scp
uses a capitalP
for port, soscp -P 2210 file user@localhost:~/destfile
. I really don't know whyssh
andscp
are inconsistent there -- probably for historic reasons, as always when you can't explain something with arguments;)
– mpyMay 23, 2013 at 12:34 -
@mpy: This gives me an new error message
ssh: connect to host localhost port 2210: Connection refused lost connection
– jruebsamMay 23, 2013 at 12:38 -
@mpy: Ok, i don't know where the mistake was but it seems to work now with the command like above– jruebsamMay 23, 2013 at 15:42
I would recommend mounting the remote file system locally using sshfs
. I don't know the details of your setup but I'll give you an example. I set up a tunnel through a remote server (R1) to an inaccessible second server (R2) on R1's network with this command:
ssh -fN -p 24222 user@R1 -L 2222:R2:22
I can now connect to R2 like so:
ssh -p 2222 127.0.0.1
I can also use sshfs
to locally mount a directory from R2:
sshfs -p 2222 127.0.0.1:/path/to/dir /mnt/mountpoint
I have tried this using a tunnel through one not two remote servers but I see no reason why it should not work with 3 or more as long as the tunnel has been properly set up.
This is not exactly what you asked for but it should serve as a workaround. Once you have the remote file system mounted locally, you can use simple cp
to copy files to/from it.
-
I actually used this method before, the problem is that the connection is kind of unstable and it often happens that my terminal and the file browser freeze– jruebsamMay 22, 2013 at 17:01
-
1
-
Thank you for your reply, i think i might give autofs a try, i hope it really works better then with sshfs.– jruebsamMay 23, 2013 at 11:10
-
sshfs
has nothing to do with it...scp
works just fine once you setup the tunnel withssh -fN
– slfSep 5, 2014 at 19:07 -
@slf of course, it is just a more convenient way of doing this sort of thing if you are going to be doing it often.– terdonSep 5, 2014 at 19:22
W -- ? -- ? -- P
?
?W -- M1 -- R1 -- M2 -- P
? Or what exactly is the network path between W and P?