I am creating a SOCKS proxy using OpenSSH dynamic port forwarding on an ssh-server in a keepalive cluster containing 3 machines.
- The virtual ip of this cluster is 1.1.1.4
- The master node of the cluster is 1.1.1.3
- The other two machines are on 1.1.1.1. & 1.1.1.2 and can probably be ignored for this question
I create my SOCKS proxy with the following command from my ssh-client
ssh -D1080 1.1.1.4
I send my request through localhost:1080
from the ssh-client machine and the request is forwarded through the proxy successfully.
I have a firewall with a rule to allow traffic from 1.1.1.4 to pass through. The problem is that since the ssh connection to 1.1.1.4 resolves to the master node at 1.1.1.3, the forwarded request is seen as coming from 1.1.1.3, rather than 1.1.1.4.
The result is that I will need to set up a firewall rule for all 3 of the machines in that cluster for each of their ip addresses. I would prefer to just have one rule for all 3 on the shared virtual ip, but for that to be an option the forwarded request will need to be seen as being sourced from the virtual ip.
Is my goal ill-conceived; is there a reason that this would be undesirable, or is there a way to achieve what I want without creating a mess?
Thanks
Joe