2

I have two machines. both behind NAT. Also I have access SERVER from each machines. Is there way to do ssh tunnel from machine1 to machine2 via SERVER?

Client machines are linux mint. SERVER is debian. I have only user access rights on all machines

2
  • Since you don't provide any details, neither will I: Yes, it's possible. Which OS are we talking about? Which implementation of ssh do you have? Which access levels do you have access to?
    – Jarmund
    May 5, 2015 at 10:18
  • @Jarmund why not just answer for a standard implementation like openssh
    – barlop
    May 5, 2015 at 10:52

2 Answers 2

0

I can see how it could be done..

So you have 3 computers. A,B,C

A,B are behind NAT. Let's say B is the intermediary

Method 1

2 tunnels

So you can make an SSH connection from A to B (Tunnel 1). And from C to B(Tunnel 2). And forward Tunnel 1, to tunnel 2.

Computer A connects with SSH -L

Computer C connects with SSH -R

The -L or -R determines which side of the tunnel listens and which side of the tunnel forwards.

So, unless I have erred, you could do something like-

A$ ssh -L 1234:127.0.0.1:2345 user@compB
C$ ssh -R 2345:127.0.0.1:3456 user@compB

But i'm not sure if you can make two connections to the same SSH server, so try this.. Making two different sshd servers..

edit sshd_config on CompB and you'll see it says Port 22 add a line below it that says Port 222 Then CompB will run an ssh server on two ports.

Then you could connect to the ssh servers on two different ports 22 and 222

A$ ssh -L 1234:127.0.0.1:2345 user@compB -p22
C$ ssh -R 2345:127.0.0.1:3456 user@compB -p222

Port 1234 is the port on computer A where you connect your client program.. it's the entry to tunnel 1

Port 2345 is the port on computer B and entry to tunnel 2

Port 3456 is the port you run the server program on CompC

So in this manner, CompA can connect to a server on CompC, through CompB

Method 2

one tunnel

An option, is just using one tunnel, but then you only get encryption along half the route. 5.6.7.8 is the IP of CompC and port 3456 is the server on CompC and port 1234 is the listening port for the tunnel.

A$ ssh -L 1234:5.6.7.8:3456 user@compB

Then on CompA connect the client program to port 1234 on CompA and it will all go to CompC.

2
  • this command A$ ssh -L 1234:127.0.0.1:2345 user@compB in method1 just log me to compB. I must use '-f -N' flags because of I no nned the shell connection to compB May 5, 2015 at 12:01
  • It doesn't only get you a shell. It creates a tunnel too, and you can on CompA connect your client program to 127.0.0.1:1234 and connect to the tunnel. You can indeed use -f and -N to stop the shell from appearing, though it's not necessary to add those switches to get the tunnel, so it's up to you if you want to add those switches. But you'll get the tunnel without them also.
    – barlop
    May 5, 2015 at 12:15
0

based on reply of barlop

I have A and B behind NAT. And C which is accessed from A and B

On C I must have only ssh access. Nothing else is required.

on machine A add task to crontab

$crontab -e

TUNCMDR='ssh -f -N -R 1144:localhost:22 Cuser@hostC'
* * * * * pgrep -f "$TUNCMDR" || ($TUNCMDR  &&  echo "`date`: Land remote port to localhost:22" >> ~/ssh-world.log)  &>/dev/null
TUNCMDL='ssh -f -N -L 1234:localhost:1143 Cuser@hostC'
* * * * * pgrep -f "$TUNCMDL" || ($TUNCMDL  &&  echo "`date`: Forward local 1234 port to remote" >> ~/ssh-world.log)  &>/dev/null

on machine B add task to crontab

$crontab -e

TUNCMDR='ssh -f -N -R 1143:localhost:22 Cuser@hostC'
* * * * * pgrep -f "$TUNCMDR" || ($TUNCMDR  &&  echo "`date`: Land remote port to localhost:22" >> ~/ssh-world.log)  &>/dev/null
TUNCMDL='ssh -f -N -L 1234:localhost:1144 Cuser@hostC'
* * * * * pgrep -f "$TUNCMDL" || ($TUNCMDL  &&  echo "`date`: Forward local 1234 port to remote" >> ~/ssh-world.log)  &>/dev/null

NOTICE: 1143 and 1144 ports are changed on host B in compare to host A

on host A to connect to B you run ssh -p 1234 Buser@localhost
on host B to connect to A you run ssh -p 1234 Auser@localhost
on host C to connect to A you run ssh -p 1144 Auser@localhost
on host C to connect to B you run ssh -p 1143 Buser@localhost

You can see reconnection info running cat ~/ssh-world.log

UPD

Stop session disconnects/hungups by adding to ~/.ssh/config

Host *
    ServerAliveInterval 15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.