I want to copy files from a remote computer (W) to a private host computer (P) via scp. Since i can't connect to machine W directly i use an ssh tunnel over 2 different machines with port 22. What i would like to do, is to log into machine W and from there do an scp file transfer to machine P, the problem is that P is hidden in an network so i cant specify a remote host ip when i am logged into machine W. Is there a solution for this ?? I manage to do this when i am logged into machine P, but i dont want to remember the file path each time i copy a file.

  • So your setup looks something like this? W -- ? -- ? -- P – Janos Pasztor May 22 '13 at 16:06
  • yes exacty, there are 2 machines between these computers on which i do a port forwarding, the problem is that W is hidden behind some kind of router.. of my dormitory – jruebsam May 22 '13 at 16:09
  • Do you have shell access to the router/host in front of P? Or can you do a port forwarding on either of the ones marked by ?? – Janos Pasztor May 22 '13 at 16:24
  • i don't have any access to the router, i have access to both machines in the middle (lets call them M1 and M2), but not as root, and i can also do a portforward to M2 for example – jruebsam May 22 '13 at 17:00
  • Wait a second, is your network setup actually looking like this? W -- M1 -- R1 -- M2 -- P ? Or what exactly is the network path between W and P? – Janos Pasztor May 22 '13 at 17:55

After clarifying your setup as discussed above, your system looks like this:

P -- R -- M1 -- M2 -- W

R is a NAT router that only allows connections from P to M1, but not the other way around and all nodes must be used in order to establish a connection.

Solution 1

Your only real problem is the router R over which you have no control, so you must somehow establish a tunnel to allow W to connect back. The simplest solution would be to have P establish an SSH connection to M1 and establish a reverse port forward there.

You can then set up a second SSH tunnel from W to M2 to forward local packets to the reverse port forwarded port on M1, which can in turn be used to establish a tunneled SSH connection from W to P.

Solution 2

Now this adds quite some complexity to the whole setup, which makes it quite error prone. A better solution would be to establish a VPN connection between W and M1, P and M2 and between M1 and M2. Then you could establish a routing using a private address range from W to P over these three tunnels. For this to work you need root access to both M1 and M2 AND you need to set up proper firewalls so nobody from the outside gets into your VPN's.

There are of course other solutions as well, but what you need to think through how the packets are going to get through all these blockades, the actual solution can then be tailored to fit your tools.

  • Thank you for your reply, i managed to get Solution 1 to work, Solution 2 drops out since i don't have root access. I now can login from W to P with ssh -l userame -p 2210 localhost. Just one question left is, how exactly do i use scp i.e. pass the username the port etc, i didn't managed to get this to work ? I tried something like scp parameter.ini -p 2210 username@localhost:~/parameter2.ini after three password attempts i get the following message Permission denied (publickey,keyboard-interactive). lost connection – jruebsam May 23 '13 at 11:04
  • 1
    @jruebsam: scp uses a capital P for port, so scp -P 2210 file user@localhost:~/destfile. I really don't know why ssh and scp are inconsistent there -- probably for historic reasons, as always when you can't explain something with arguments ;) – mpy May 23 '13 at 12:34
  • @mpy: This gives me an new error message ssh: connect to host localhost port 2210: Connection refused lost connection – jruebsam May 23 '13 at 12:38
  • @mpy: Ok, i don't know where the mistake was but it seems to work now with the command like above – jruebsam May 23 '13 at 15:42

I would recommend mounting the remote file system locally using sshfs. I don't know the details of your setup but I'll give you an example. I set up a tunnel through a remote server (R1) to an inaccessible second server (R2) on R1's network with this command:

ssh -fN -p 24222 user@R1 -L 2222:R2:22

I can now connect to R2 like so:

ssh -p 2222

I can also use sshfs to locally mount a directory from R2:

sshfs -p 2222 /mnt/mountpoint

I have tried this using a tunnel through one not two remote servers but I see no reason why it should not work with 3 or more as long as the tunnel has been properly set up.

This is not exactly what you asked for but it should serve as a workaround. Once you have the remote file system mounted locally, you can use simple cp to copy files to/from it.

  • I actually used this method before, the problem is that the connection is kind of unstable and it often happens that my terminal and the file browser freeze – jruebsam May 22 '13 at 17:01
  • 1
    @jruebsam You should be able to avoid such problems if you mount the sshfs share using autofs (see here) with the soft option. – terdon May 23 '13 at 3:12
  • Thank you for your reply, i think i might give autofs a try, i hope it really works better then with sshfs. – jruebsam May 23 '13 at 11:10
  • sshfs has nothing to do with it... scp works just fine once you setup the tunnel with ssh -fN – slf Sep 5 '14 at 19:07
  • @slf of course, it is just a more convenient way of doing this sort of thing if you are going to be doing it often. – terdon Sep 5 '14 at 19:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.