Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've been hunting all over the inter webs and I cannot find a simple example of the form of port forwarding that I am looking for. Well, the truth is, I may have just simply not understood the jargon used and then overlooked a valid solution.

Here is the proposed setup. I have a computer at home (homeC) and I typically connect to a server at work (workServer.com), but whenever I connect to the server, I am generally (90%+ of the time) simply hopping over to another computer on the network (localC 192.168.x.y). I would love to setup workServer.com to port forward over to the other local computers ip addresses if I use a non-standard port (e.g. 12345).

Assume all computers involved are running some variant to unix, but that the user only has root access on some computers (not workServer.com). In fact, the username user is the same on all computers. I am trying to find ways to solve the following problems:

  1. a command to use in workingServer.com which will forward a port to a given local computer (I also need to know which ports are available, I suppose)
  2. the command to run on homeC to connect to localC

On a side note, it would be interesting if it were possible to limit the mac-addresses of computers that can connect to user@*workingServer.com* because I see this as greatly increasing my security.

If you have any other ideas or useful suggestions, I would greatly appreciate them.

share|improve this question
add comment

2 Answers

up vote 1 down vote accepted

Tunneling would be the appropriate term if you are connecting with SSH.

putty.exe -ssh username@publicip -pw password -L localport:privateip:destinationport

so as an example, if I were to tunnel through SSH to port 80 on a computer with address 192.168.1.15 behind a public IP address of xxx.xxx.xxx.xxx, on which the SSH server resides, I would do the following:

putty.exe -ssh username@xxx.xxx.xxx.xxx -pw password -L 8080:192.168.1.15:80

I could then open up a web browser to 127.0.0.1:8080 and up would pop whatever is being served on port 80 on the remote machine.

share|improve this answer
    
Thanks a lot for your post. After reading some other things and seeing your post, I think this almost gets me where I want to be. First, on homeC I run $ ssh workServer.com -L 2020:192.168.x.y:22, which actually takes me to workServer, but I can run in another shell ssh -p 2020 localhost to get me from homeC to 192.168.x.y (on workServer). That's rather convenient, but is there a way to suppress the original command from taking me to workServer in the terminal (ie. perform this action in the background, maybe a line in my bash profile?). Thanks a lot for the advice –  scicalculator Aug 19 '11 at 6:55
    
@dat5h: You need the -N option, see the ssh man-page. –  eldering Aug 19 '11 at 7:01
    
@eldering , Thanks so much. Right now I have $ ssh -N workServer.com -L 12345:192.168.x.y:22 &, and it seems to work great! Thanks a lot to both of you. –  scicalculator Aug 19 '11 at 7:14
    
Just wanted to come and give the final solution that I chose. The following two lines will work well in a shell script, and because of "sleep 60" it will automatically disconnect the port when I disconnect from the forwarded session. Also, this will open into a tmux session and close the ssh connection when detached (very handy for me :) )ssh -f2 -L $port:$localIP:22 workServer.com 'sleep 60' > /dev/null 2> /dev/null ; ssh -q -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -p $port localhost -t 'tmuxScript.sh' . It's a combination of things I found all over the web and here. –  scicalculator Aug 21 '11 at 22:40
add comment

The technology you're looking for is called "Network Address Translation" or NAT for short. The solution is OS specific. It will usually involve installing or activating routing software. You want to configure workServer.com as a router and use NAT to forward the ports. If workServer.com was running FreeBSD, then you'd do this http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/network-natd.html

You would use a firewall to filter for IPs not mac addresses. Or you would use an ssh tunnel.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.