Quick SSH proxy or routing?

Question

I have experience with using nginx to proxy sites with the proxy_pass directive. Is there something similar I can do with SSH?

Here's my home network with my machines and their hostnames:

         <the Internet>
               |
            [router]
               |
 [kenmore]---[park]---[chiswick]

How can I configure park so that whenever it gets an SSH connection, it checks the hostname and connects to either kenmore or chiswick accordingly? I know how to do this for serving HTTP, just not SSH.

Answer 1

If you have root-rights @ park you could use iptables - redirections:

• ssh -p 2201 user@park → get redirected to kenmore:22
• ssh -p 2202 user@park → get redirected to chiswick:22

iptables -t nat -A PREROUTING -$PARK_IP -p tcp --dport 2201 -j DNAT --to-destination kenmore:22
iptables -t nat -A PREROUTING -$PARK_IP -p tcp --dport 2202 -j DNAT --to-destination chiswick:22
iptables -t nat -A POSTROUTING -j MASQUERADE

(If someone has an iptables-snippet w/out NAT I'd be interested.)

Answer 2

If you have user access on kenmore, park and chiswick the simplest solution would be to use SSH keys and commands in ~/.ssh/authorized_keys.

Lets assume for simplicity you have a user on all three machines called ryan.

On park, create two SSH keypairs:

$ ssh-keygen -C kenmore -f kenmore.rsa
$ ssh-keygen -C chiswick -f chiswick.rsa

In kenmore.rsa.pub, prefix the contents so that it reads:

command="ssh ryan@kenmore" ssh-rsa KEY_HERE

In chiswick.rsa.pub, prefix the contents so that it reads:

command="ssh ryan@chiswick" ssh-rsa KEY_HERE

Append the entire contents of both kenmore.rsa.pub and chiswick.rsa.pub into ~/.ssh/authorized_keys on separate lines.

If you now login to park using either of the keyfiles (kenmore.rsa or chiswick.rsa) you will notice a prompt for password - this should be the SSH prompt for either kenmore or chiswick, depening on which keyfile you used.

Answer 3

If I understand your requirement correctly, I believe it's just not possible.

When you're serving HTTP, a client does a DNS lookup of the host, and sends a HTTP request to that host which includes the original hostname (from client's viewpoint) in the request headers. When the request hits the server, the server is able to make decisions on how to process it based on the incoming IP address and/or client's idea of the hostname.

With SSH on the other hand, once the DNS lookup is done, only the IP address is used, and the hostname that was used by the client to resolve that IP is never seen by the server.

Some other options you might want to consider -

• Have multiple SSH daemons listening on different ports, each one redirecting to a different host. On the client you could set your ~/.ssh/config with something like this:

  Host kenmore
  Port 2201
  
  Host chiswick
  Port 2202
  

  (this is assuming that they both resolve to an IP that will first hit park.)

• On your client, just run a 2nd SSH from park as the command to your first SSH, e.g.

  ssh -t kenmore ssh kenmore
  

  (assuming kenmore resolves to park's IP from the outside, but park knows the real IP for kenmore for that 2nd SSH once you're inside)

• Run something like GateOne on park and tunnel it all over HTTP, with park acting a jumphost/gateway to the SSH terminals you need on the inside.

Answer 4

This is an unusual configuration because it replaces what can be achieved by means of a 10-dollar switch. But of course, if a 10-dollar switch can do it, a fortiori a pc can do it. There must be a gazillion ways to do it, this is just a simple one.

Let us suppose your router gives addresses in the 192.168.1.21-50 range, and let us call eth0 park's interface with the router, eth1 that with kenmore and eth2 that with chiswick.

1) Let park get its IP address via DHCP from the router.

2) Let us give static IP addresses to kenmore and chiswick. For instance kenmore 192.168.1.5 and chiswick 192.168.1.10. Please note that both are outside the range used by your router, so that there be no conflicts.

3) Depending on the OS on kenmore/chiswick, you may need to set up a routing table on them. In Linux, you should have

  sudo route add default gw 192.168.1.1

and similarly on Mac, but on Windows I think this is automatic.

4) On park: first, let us allow IPv4 forwarding: as sudo edit /etc/sysctl.conf and change this line

 #net.ipv4.ip_forward=0

to

 net.ipv4.ip_forward=1

Save the file, issue the command:

 sudo sysctl -p

5) Second, on park, let us add these two routes to the routing table:

 sudo route add -host 192.168.1.5 dev eth1
 sudo route add -host 192.168.1.10 dev eth2

Now you are good to go.