0

There are 3 computers:

  • local machine (osx)
  • server1 (centos 7 at data center port 22 open)
  • server2 (centos 7 closed behind nat)

server2 maintains a reverse tunnel to server1 on port 2222. Running ssh localhost -p 2222 on server1 goes directly to the command line of server2

What is the best way to set up a tunnel from the local machine through server1 to server2? For instance it is possible to initiate a tunnel from localhost to server1 using ssh -D 5000 -N root@server1.

How to make the extra hop and get the tunnel go all the way through from localhost to server1 to server2? I tried this kind of thing ssh -L 5000:localhost:5000 root@server1 ssh -L 5000:server2:2222 -N root@localhost but it didn't work

e.g. localhost -5000-> server1 -2222-> server2

Improve this question

1 Answer 1

Reset to default
1

By making the reverse tunnel, you tied localhost:2222 on server1 to server2. I'd recommend that you now make a tunnel on some port number of your local osx machine to server1 (I selected 9999 in this example), just to make access to the reverse tunnel you created before, i.e.,

ssh -L 9999:localhost:2222 root@server1

Leave that open, so that you have your double hop to server2 ready for use. Next, in a separate terminal, you should be able to do

ssh -p 9999 root@localhost

and gain access to server2. For security reasons, I'd recommend not to use root for SSH connections.

Improve this answer
3
  • when i try ssh -L 9999:localhost:2222 root@server1it just logs in to server1 instead of opening a tunnel
    – MitchBroadhead
    Nov 18, 2016 at 18:56
  • True, it does login to server1 indeed, however, besides that, it also opens a route to server2. A tunnel is not the same as an SSH connection. That's why you need to execute this first statement, to tie port 9999 of your osx machine to port 2222 of the localhost interface of server1 (which convientiently links to server2 as you confirmed works), and you want to keep this connection open. Then, you open a second terminal and execute the second command to connect (via the tunnel) to server2.
    – Sander
    Nov 23, 2016 at 15:06
  • it does work as you suggest and i can indeed log into server2 through the tunnel. normally i expected the command to hang while the tunnel was open. to open a tunnel all the way through (for web browsing or vnc) i used ssh -D 5000 -N root@localhost -p 9999 after issuing the first command. is there any way to represent all that as a one liner?
    – MitchBroadhead
    Dec 2, 2016 at 15:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .