ML
    • Recent
    • Categories
    • Tags
    • Popular
    • Users
    • Groups
    • Register
    • Login

    SSH tunneling/gateway question

    Scheduled Pinned Locked Moved IT Discussion
    ssh tunnelgateway
    16 Posts 7 Posters 1.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • IRJI
      IRJ
      last edited by

      Can you be a little more specific on what you are trying to accomplish?

      Are you just trying to have access to files?

      1 1 Reply Last reply Reply Quote 0
      • 1
        1337 @IRJ
        last edited by 1337

        @IRJ said in SSH tunneling/gateway question:

        Can you be a little more specific on what you are trying to accomplish?

        Are you just trying to have access to files?

        Kind of. I want to be able to update packages on remote servers that sit behind hardware firewalls that don't allow any outbound traffic.

        While it's no problem downloading individual package files over ssh and updating that way, it's a lot of work getting all the dependencies and all the packages transferred and installed in the right order. So I want to let the package manager on the remote servers (apt in this case) access the software repositories on the local LAN (of the ssh client) over the ssh connection.

        1 Reply Last reply Reply Quote 0
        • 1
          1337
          last edited by 1337

          Simplified the plan looks something like this:
          remote_apt.png
          In reality there are more firewalls, VPN links and other stuff (think large enterprise network).

          1 Reply Last reply Reply Quote 0
          • 1
            1337
            last edited by

            It would have been better to have a package repository located with the remote servers and let that server have outbound access. But this is the way it is right now.

            1 Reply Last reply Reply Quote 0
            • black3dynamiteB
              black3dynamite
              last edited by

              What about something like this?

              https://unix.stackexchange.com/a/116211
              63837473-9791-426f-bda9-8789c77826fa-image.png

              1 1 Reply Last reply Reply Quote 0
              • 1
                1337 @black3dynamite
                last edited by 1337

                @black3dynamite said in SSH tunneling/gateway question:

                What about something like this?

                https://unix.stackexchange.com/a/116211
                63837473-9791-426f-bda9-8789c77826fa-image.png

                That is the local tcp forwarding. I knew that could be done but in this case it's the opposite direction I need, the remote tcp forwarding. It's like putting internet and the proxy on Computer B instead.

                1 stacksofplatesS 2 Replies Last reply Reply Quote 0
                • 1
                  1337 @1337
                  last edited by

                  @Pete-S said in SSH tunneling/gateway question:

                  @black3dynamite said in SSH tunneling/gateway question:

                  What about something like this?

                  https://unix.stackexchange.com/a/116211
                  63837473-9791-426f-bda9-8789c77826fa-image.png

                  That is the local tcp forwarding. I knew that could be done but in this case it's the opposite direction I need, the remote tcp forwarding. It's like putting internet and the proxy on Computer B instead.

                  I think I have it figured out though. Just need to try it on a couple of test VMs first.

                  1 Reply Last reply Reply Quote 0
                  • dafyreD
                    dafyre @scottalanmiller
                    last edited by

                    @scottalanmiller said in SSH tunneling/gateway question:

                    Yes, SSH tunneling makes a VPN that can work in either direction.

                    I never knew you could do this with SSH... Why is this not more commonly done?

                    scottalanmillerS 1 Reply Last reply Reply Quote 0
                    • scottalanmillerS
                      scottalanmiller @dafyre
                      last edited by

                      @dafyre said in SSH tunneling/gateway question:

                      I never knew you could do this with SSH... Why is this not more commonly done?

                      It's pretty darn common. It's the most common vendor support VPN tool, for example.

                      1 Reply Last reply Reply Quote 0
                      • stacksofplatesS
                        stacksofplates @1337
                        last edited by

                        @Pete-S said in SSH tunneling/gateway question:

                        @black3dynamite said in SSH tunneling/gateway question:

                        What about something like this?

                        https://unix.stackexchange.com/a/116211
                        63837473-9791-426f-bda9-8789c77826fa-image.png

                        That is the local tcp forwarding. I knew that could be done but in this case it's the opposite direction I need, the remote tcp forwarding. It's like putting internet and the proxy on Computer B instead.

                        Yeah essentially replace the -L with a -R. It's the same thing.

                        1 Reply Last reply Reply Quote 2
                        • 1
                          1337
                          last edited by 1337

                          OK, this is what I ended up doing.

                          I wanted the remote server to have access to a local repository served over http. This works with any kind of traffic over tcp though, as it's not a web proxy but tcp forwarding.

                          I set up the files and served the website on the ssh client machine with PHPs build-in server. It's easy to use and requires no setup. You just start it in the base directory you want to serve. I used port 8000.

                          php -S localhost:8000
                          

                          Then access the remove server from the client with the reverse tcp forwarding active.
                          Basically forwarding port 8000 on the remote host to port 8000 on the local ssh client.

                          ssh -R 8000:localhost:8000 remote_ip
                          

                          But since I was connecting with a windows machine I used putty instead.
                          This is how you set up the tcp forwarding:
                          putty_reverse_tcp_forwarding.png

                          It seems like you can not only forward one port, but many ports and in whatever direction you want at the same time.

                          To try that you have things working:

                          wget localhost:8000
                          

                          In my case I wanted apt package manager to use the forwarded port so I just changed it to use http://localhost:8000 to access the packages.

                          stacksofplatesS 1 Reply Last reply Reply Quote 0
                          • stacksofplatesS
                            stacksofplates @1337
                            last edited by

                            @Pete-S said in SSH tunneling/gateway question:

                            OK, this is what I ended up doing.

                            I wanted the remote server to have access to a local repository served over http. This works with any kind of traffic over tcp though, as it's not a web proxy but tcp forwarding.

                            I set up the files and served the website on the ssh client machine with PHPs build-in server. It's easy to use and requires no setup. You just start it in the base directory you want to serve. I used port 8000.

                            php -S localhost:8000
                            

                            Then access the remove server from the client with the reverse tcp forwarding active.
                            Basically forwarding port 8000 on the remote host to port 8000 on the local ssh client.

                            ssh -R 8000:localhost:8000 remote_ip
                            

                            But since I was connecting with a windows machine I used putty instead.
                            This is how you set up the tcp forwarding:
                            putty_reverse_tcp_forwarding.png

                            It seems like you can not only forward one port, but many ports and in whatever direction you want at the same time.

                            To try that you have things working:

                            wget localhost:8000
                            

                            In my case I wanted apt package manager to use the forwarded port so I just changed it to use http://localhost:8000 to access the packages.

                            Right you can name any number of ports. If you want to do dynamic tunneling you can pass a -D and use the remote host as a SOCKS proxy. Then only define the one port for the proxy in your browser or wherever.

                            SSH is pretty awesome.

                            1 Reply Last reply Reply Quote 1
                            • CloudKnightC
                              CloudKnight
                              last edited by

                              using ssh to tunnel rdp is quite handy as well.

                              1 Reply Last reply Reply Quote 1
                              • 1 / 1
                              • First post
                                Last post