1

I need advice how to make proper ssh connections.

My network:

enter image description here

I want to be able to view web server content from devices B_1, B_2, B_3 using FF with SOCKS configured on Client A. Note that firewall doesn't allow incoming connections, and that cannot be changed.

I can achieve now something similar by opening single tunnel for each machine (B_1,B_2,B_3), and browse content by typing http://localhost:5678 in FF, without SOCKS on Client A

On Server B -> B_1

ssh -f -n -T -R5678:192.168.1.2:80 user@serverA

On Client A

ssh -L 5678:localhost:5678 user@serverA

I think i need to use ssh -D on server B to be able to connect to machines B_1,B_2,B_3, just typing IP address in FF with SOCKS set up localhost:5678 on Client A, but i'm doing something wrong, because I can't get it to work. Any help will be appreciated :)

4
  • Thx, but i cannot connect directly from B to C because there is a firewall between that doesn't allow incoming connections to C that's why I need to initialize ssh connection from C to B and somewhere here add ssh -D Or maybe there is another method to achieve my goal. Jun 28, 2021 at 11:13
  • @KamilMaciorowski, do you think that will work: on C ssh f -n -D 5432:localhost ssh -f -n -T -R5432:localhost:5432 user@serverA on B ssh -L 55432:localhost:5432 user@serverA Jun 28, 2021 at 11:20
  • Regarding your tries, the most important thing: ssh -D must be run on the machine that you choose as B (in the context of my linked answer) and it must connect to C (possibly via a tunnel; in your case obligatorily, I think). The command really defines what machine is B and what is C. Jun 28, 2021 at 11:29
  • To clarify, Client A is behind NAT/Firewall, Server A with public IP can be reached from anywhere, Server B is also is behind NAT/Firewall, answering yours question, Yes i can open ports on Server A Jun 28, 2021 at 11:52

2 Answers 2

1

Please see how to create a SOCKS proxy with ssh. This is an excerpt from my answer there:

In general the situation without SOCKS proxy provided by ssh is like this:

A -> D

where A is a client (e.g. web browser), D is a server (e.g. web server). But with proxy this is as follows:

A -> B -> C -> D

where:

  • A represents a single client that uses B:$port_number as SOCKS address; there may be many clients.
  • B is the machine where ssh -D $port_number C runs and where the TCP $port_number listens for incoming connections from any A.
  • C is the $hostname B connects to; communication that normally goes to D from A now reaches D from C.
  • D is any server, it sees communication from C and may not be aware that A and B are involved; there may be many servers.

Some of these letters may refer to same machine in some particular usage cases. […]

I would like to refer to the linked answer. Unfortunately it uses capital letters A, B to name some (abstract) machines; and your question also uses them to name some (real) machines. To mitigate the "collision" I will use standalone letters in the "namespace" of the linked answer; I will use more descriptive terms like "Server B" in the "namespace" of your question.

You want to be able to reach any "Server B_?" from the "Client A". The ultimate server should see the connection coming from the "Server B". This means:

  • your "Client A" is A,
  • your "Server B" is C,
  • any "Server B_?" is D.

You need to pick B, so A can reach B and B can reach C. There are few possible variants:

  1. Your "Server B" can be B (and still be C), if only you allow A to reach it via SSH tunnel(s). In your case this would require chaining two tunnels (or tunneling a tunnel). There is simpler alternative, therefore I won't elaborate (yet).

  2. Your "Server A" can be B, if only you allow it to reach the SSH server on C via SSH tunnel. This requires the SOCKS proxy on "Server A" to be reachable from "Client A" (i.e. A), so you need to make it publicly available or to use another tunnel. Still not simple, I won't elaborate.

  3. Your "Client A" can be B (and still be A), if only you allow it to reach the SSH server on C via SSH tunnel(s). Let's do this:

    # on Server B
    ssh -R 5678:localhost:22 userA@serverA
    

    This makes the SSH server of the "Server B" (i.e. C) available as serverA:5678. Assuming you can open this TCP port on the "Server A", now you can reach C from B:

    # on Client A
    ssh -D 1234 -p 5678 userB@serverA
    

    Yes, you specify userB because it's "Server B" you're really connecting to; use credentials valid for "Server B".

    Now the browser(s) on Client A (i.e. A) should use localhost:1234 as SOCKS proxy. To reach "Server B_?" a browser should probably use URLs as if the browser was on "Server B" (see If I am using SSH for a SOCKS proxy, do DNS connections go through it?).

    Note the SSH server of the "Server B" is now publicly available as serverA:5678. I mean if an attacker wants to target the "Server B" and finds serverA:5678 then their task will be easier than when the "Server B" was totally hidden behind NAT.

    With yet another tunnel (so two chained tunnels in total; or a tunneled tunnel) one can avoid exposing the SSH server of "Server B" to public. The whole setup will be similar to (1) and the difference will be in what is tunneled and which machine acts as B. For completeness let's do this as variant 4 below.

  4. "Client A" as B (and still as A), without exposing the SSH server of "Server B" thanks to chained tunnels:

    # on Server B
    ssh -R 5678:localhost:22 userA@serverA
    

    # on Client A
    ssh -L 5678:localhost:5678 userA@serverA
    

    This makes the SSH server of the "Server B" (i.e. C) available as localhost:5678 on "Client A" (i.e. B). So like in (3) you can reach C from B, this time like this:

    # on Client A
    ssh -D 1234 -p 5678 userB@localhost
    

    The browser(s) on "Client A" (i.e. A) should use localhost:1234 as SOCKS proxy. From their point of view this variant is exactly like the previous one.

2
  • Thank you very much for your answer, it helped me a lot. But I achieved my goal, in slightly different way. # On Server B ssh -N -f -D 5678 userA@localhost ssh -f -N -T -R5678:localhost:5678 userA@serverA #On Client A ssh -L 5678:localhost:5678 userA@serverA And it works like I wanted to. In conclusion ssh -D can be at both sides of tunnel Jun 28, 2021 at 18:38
  • @HubertVonSüßerBusarzt It seems you chose (1) then. All right. Jun 28, 2021 at 18:48
0

the answer above #3 option doesnt work without -J option

#on Server B
ssh -R 5678:localhost:22 userA@serverA


#on Client A
ssh -D 1234 -J userA@serverA -p 5678 userB@localhost

and

GatewayPorts yes 

in sshd config

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .