0

I am creating a SOCKS proxy using OpenSSH dynamic port forwarding on an ssh-server in a keepalive cluster containing 3 machines.

  • The virtual ip of this cluster is 1.1.1.4
  • The master node of the cluster is 1.1.1.3
  • The other two machines are on 1.1.1.1. & 1.1.1.2 and can probably be ignored for this question

I create my SOCKS proxy with the following command from my ssh-client

ssh -D1080 1.1.1.4

I send my request through localhost:1080 from the ssh-client machine and the request is forwarded through the proxy successfully.

I have a firewall with a rule to allow traffic from 1.1.1.4 to pass through. The problem is that since the ssh connection to 1.1.1.4 resolves to the master node at 1.1.1.3, the forwarded request is seen as coming from 1.1.1.3, rather than 1.1.1.4.

The result is that I will need to set up a firewall rule for all 3 of the machines in that cluster for each of their ip addresses. I would prefer to just have one rule for all 3 on the shared virtual ip, but for that to be an option the forwarded request will need to be seen as being sourced from the virtual ip.

Is my goal ill-conceived; is there a reason that this would be undesirable, or is there a way to achieve what I want without creating a mess?

Thanks

Joe

2
  • This article is seems relevant: serverfault.com/questions/585264/… Mar 19, 2018 at 13:20
  • As well as it not being possible for ssh to bind to a specific outgoing ip address on the server, (as the above answer confirms), I don't think a keepalive address is considered to be a network interface by the node and so might not even be discoverable using iptables. If anyone can shed any light on whether keepalive addresses can be mapped to using iptables, or why it is that the firewall appears to see normal https traffic as coming from the keepalive virtual ip I would be grateful. Mar 19, 2018 at 13:20

0

You must log in to answer this question.

Browse other questions tagged .