I am physically on a machine that is behind a firewall and cannot be ssh'd into. Let's call that PC. PC can connect out to two machines, one on AWS and one that is part of a vpn connection, call them A and V, respectively. A and V cannot talk to each other directly. I need to frequently move files between A and V and have been doing this by scp'ing to PC and then scp'ing from pc. Is there a better way to do this? A and V are linux but PC has cygwin.


Yes, it can be done.

1) make sure you have set up password-less ssh on all three machines, i.e., using cryptographic keys;

2) downlaod the package autossh on machine PC; then make a file called auto1 with this content:

 /usr/lib/autossh/autossh -M 6521 -f -p SSH_PORT_OF_A -2 -N -D -R 8100:localhost:SSH_PORT_OF_PC Your_Name@A's_IP_Address -i /path/to/A's/private/key

and another file called auto2 with equivalent content:

 /usr/lib/autossh/autossh -M 6521 -f -p SSH_PORT_OF_V -2 -N -R 8100:localhost:SSH_PORT_OF_PC Your_Name@A's_IP_Address -i /path/to/A's/private/key

make these two files executable,

  chmod 755 auto1
  chmod 755 auto2

and now add the following line to /etc/rc.local:


What this does is to start at boot autossh, a smart program which keeps re-starting ssh if it is disconnected; the ssh connection is a reverse tunnel, all connections to localhost:8100 on A and V are automatically forwarded to PC's port which I called SSH_PORT OF_PC, you should substitute your values for this and for SSH_PORT_OF_A, SSH_PORT_OFV.

Careful: you must already have connected via ssh to these two machines previously, i.e. there must alrwady have been an exchange of keys.

3) Put the private cryptografic keys of A and V in /home/Your_Name/.ssh.

4) Now you can connect from A (or V) to PC by means of

 ssh  Me_at_PC@localhost -p 8100 -i /path/to/PC'sPrivateKey

5) But you can also jump from A to V via PC like this:

ssh  -t Me_at_PC@localhost -p 8100 -i /path/to/PC'sPrivateKey ssh -t Me_at_V@V's_IP_address -p SSH_PORT_OF_V -i /home/My_name_On_VG/.ssh/PrivateKeyOfV

and viceversa, 

ssh  -t Me_at_PC@localhost -p 8100 -i /path/to/PC'sPrivateKey ssh -t Me_at_A@A's_IP_address -p SSH_PORT_OF_A -i /home/My_name_On_VG/.ssh/PrivateKeyOfA

6) This can be simplified, either by assigning aliases to these two long commands, or by learning how to use the ProxyCommand option of ssh.

7) While this configuration works verbatim for me, this may be because there is a little something which I take for granted in my system but which is missing from yours. Be prepared to do a little debugging.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.