1

tl;dr: A -> B and C -> B works. How to get A->C to work?

I have 3 hosts

A. A local machine
B. A middle-man
C. A phone with a webapp running on port 333

Both A and C can SSH into B. So, A->B and C->B works fine but A -> C does not work.



On B, I can access this webapp at http://localhost:3344 after creating a tunnel from C:

machine-c$ /usr/bin/ssh -f -N -T -R 3344:localhost:333 user@machine-b



I would have thought that with the above tunnel working all I need is a tunnel from A->B like so:

machine-a$ /usr/bin/ssh -f -N -T -L 9999:machine-b:3344 user@machine-b

I can see the following message:

Local connections to LOCALHOST:9999 forwarded to remote address machine-b:3344

But accessing localhost:9999 hangs with the following set of messages being repeated:

debug2: channel 3: zombie
debug2: channel 3: garbage collecting
debug1: channel 3: free: direct-tcpip: listening port 9999 for machine-b port 3344, connect from ::1 port 24626 to ::1 port 9999, nchannels 4
debug1: Connection to port 9999 forwarding to machine-b port 3344 requested.
debug2: fd 10 setting TCP_NODELAY
debug1: channel 3: new [direct-tcpip]
channel 3: open failed: connect failed: Operation timed out

Am not sure whether it's relevant, but since A -> B works, I have also setup a reverse tunnel so that B -> A works too. Ditto for B-> C. So overall the following works:

A -> B

machine-a$  ssh user@machine-b

B -> A (first requires a reverse SSH Tunnel from A->B)

machine-a$  ssh -f -N -T user@machine-b -R1234:localhost:22
machine-b$  ssh -p 1234 user@machine-a 

The same has been done for C->B


How can I setup an SSH tunnel from A to C (through B?) so that I can access that webapp directly on A using localhost:3344 ?




I have looked at the following questions but can't wrap my head around what's needed:

SSH as socks proxy through multiple hosts

Forward SSH traffic through a middle machine

An SSH tunnel via multiple hops

3
  • If what you are saying is correct Station B has network access to the web application on Station C. You also stated that you are able to successfully able to access Station B from Station A via SSH. What happens when you try to access the web application hosted on Station C when you initiate a SSH connection to Station B from Station A? Apr 1, 2014 at 15:10
  • I have updated my question with the details of what happens. Please take a look.
    – TheMinion
    Apr 1, 2014 at 15:23
  • Try creating a Dynamic proxy going from A -> B and in the same session from B -> C. Apr 1, 2014 at 15:44

1 Answer 1

1

I have a similiar setup in place and it is working fine. The difference I spotted is, in your machine-a ssh command you are using 9999:machine-b:3344 while I use 9999:localhost:3344. Your way doesn't work for me either, however it doesn't produce the same errors. For completeness, this is what I get:

debug1: Connecting to localhost [::1] port 9999.
debug1: Connection established.
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.5p1 Debian-6
channel 2: open failed: connect failed: Connection refused
ssh_exchange_identification: Connection closed by remote host`

The following commands do the trick for me:

machine-c$  ssh -f -N -T -R 3344:localhost:333 user@machine-b

Now on machine-a:

machine-a$  ssh -f -N -T -L 9999:localhost:3344 user@machine-b

As I don't have anything running on machine-c's port 333, I substituted it for 22 and check that the tunnel is working by simply connecting through ssh:

machine-a$  ssh -p 9999 user@localhost
2
  • Wow! That totally works for me !!!!! Thanks a lot! Would you know why 9999:localhost:3344 works but 9999:machine-b:3344 does not ?
    – TheMinion
    Apr 1, 2014 at 21:50
  • Well, localhost address on machine-b and machine-b address are two different things. The first command (from machine-c) makes the ssh daemon on machine-b listen on 127.0.0.1::3344, but not on other adresses that machine-b has. The loopback interface is like another network device. So you were attempting to connect to the correct port, but on another network device.
    – TheDC
    Apr 2, 2014 at 14:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .