0

Setup: PC I (Ubuntu 11.10, have sudo), Mac T (OS X 10.7.2, have sudo), Smart device S (barely configurable).

S can see to I on the local network, but can't see T. I and T can see each other.

There is a program that listens on T on port N. If someone connects to the program and does not speak its proprietary protocol or does not say anything upon connection, the program shuts down and has to be painfully manually restarted.

S must connect to T on port N and speak to the program. The actual IP S connects to is configurable.

I see that I have to set up some kind of relay from I, port N to T, port N, but so far I can't wrap my head around out how to do that. Hints are welcome.

A temporary solution (e.g. running ssh with some fancy keys) is preferable to a "permanent" one (like configuring iptables or something), since this is a temporary problem.

3 Answers 3

1

Set up a remote reverse ssh tunnel on "I" to redirect port "N" on itself to port "N" on "T". That way machine S can connect to "T" via "I".

If "N" is eg port 8080, on "I" you can manually set this as

ssh -R 8080:IpofT:8080 localhost

You may add -N, -f, -n and -v if needed. See ssh man page.

There are some security issue that may be in the way. Such as if port "N" is a lower range port you need root priviliges, sudo will do.

Also by default many ubuntu servers do not allow external ip redirect. This can be toggled by configuring /etc/ssh/ssh.conf and setting

GatewayPorts yes

To automate the login you can add your own ssh key on machine "I" to the authorized_keys2 file on "I" as well (as you login via localhost). You can also set up cronjobs to test of the ssh job is running, and to kill/restart it as well.

Alternatively you can set up so that machine "T" logs into machine "I" and tunnels traffic to itself (though not familiar with ssh toolset on osx)

     ssh -R 8080:localhost:8080 username@IPofI

More information on port forwarding/tunneling on Ubuntu

1

Okey, did not notice that you preferred not to use iptables. Install socat and you can create a port forwarder like this on I:

        "LOCAL/LISTEN"   PORT        "TARGET" DEST : PORT
sudo socat TCP4-LISTEN:N,reuseaddr,fork   TCP4:T:N

like

sudo socat TCP4-LISTEN:888,reuseaddr,fork TCP4:1.2.3.4:888

See socat man-page for more info

Here's an iptables way for doing a port Destination NAT (network adress translation).

# allow forwarding
sysctl -w net.ipv4.ip_forward=1

# forward port 888 to host 1.2.3.4:888 
iptables -I PREROUTING -t nat -p tcp  --dport 888 -j DNAT --to 1.2.3.4:888

# most likely you'll need this to get routing back to your device to work.
# try without this first.
iptables -I POSTROUTING -t nat -j MASQUERADE

A bit "safer" version where you define the net from where the connections/forwarding is allowed

# forward port 888 to host 1.2.3.4:888 allowd from net 2.2.2.0/24
iptables -I PREROUTING -t nat -p tcp -s 2.2.2.0/24  --dport 888 -j DNAT --to 1.2.3.4:888
iptables -I POSTROUTING -t nat -s 2.2.2.0/24 -j MASQUERADE
0

Seems to be as simple as this:

user@I$ ssh -L I:N:T:N user@T

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .