Arch Linux

arch_fuz

Member

Registered: 2015-01-31

Posts: 61

[SOLVED] SSH Tunneling/Forwarding With Intermediate Server

Good day, everybody

I need to get a ssh connection to a host A. A is protected by firewall and allows ssh only from specific IP address (say, host B has a valid IP).
Let's assume there is a way to reach host B's sshd with a ssh client C at any random public IP.

There is a need to connect an administrative browser console from C to A.
How would one do it?

I am used to do port forwarding via ssh from C to A, while client C is a Member of B's network and using its IP by NAT.
But I do not know what to do when C is member of network X...

Thanks for your help, as always!

_fuz

Last edited by arch_fuz (Yesterday 16:16:28)

seth

Member

From: Won't reply 2 private help req

Registered: 2012-09-03

Posts: 78,877

Re: [SOLVED] SSH Tunneling/Forwarding With Intermediate Server

https://wiki.archlinux.org/title/Proxy_ … OCKS_proxy ?

---

How to upload text · How to boot w/o GUI · Disable Windows Fast-Start! · Fix your xinitrc

cryptearth

Member

Registered: 2024-02-03

Posts: 2,409

Re: [SOLVED] SSH Tunneling/Forwarding With Intermediate Server

@seth
no need for

@op
you just issue the -L option twice

[c@c ~]$ ssh -L 8080:localhost:8080 b@b
[b@b ~]$ ssh -L 8080:localhost:8080 a@a

and then connect your browser on C to http://localhost:8080/
the connection then goes from your browser to the local end of the first ssh session - this forwards from C to B - and on B the same happens which pushes it further to A
I do the exact same for manage my database on my root server: it's setup so the interface is only open to localhost on my root - to connect to my root i first connect from my main gaming rig to my home server and then from there to my root server

hint: if you chain forwarding this way ssh itself can sometimes get a bit confused on termination: it can look like when you exit/logout from C the logoff "hangs" - in this case the connection is held open by your browser - just close the browser and you'll see the connection terminates regular - same when you disconnect from B
can't tell you why of if this is just specific to chromium - but it's something to keep in mind

Last edited by cryptearth (Yesterday 15:21:18)

arch_fuz

Member

Registered: 2015-01-31

Posts: 61

Re: [SOLVED] SSH Tunneling/Forwarding With Intermediate Server

you just issue the -L option twice

Could have been so easy to find out
Thanks, I'll try.

I am also using socks via browser to connect to 127.0.0.1:n
Nowadays it is better to have listening interface to be localhost only. Otherwise AI has hit you from one minute to another.
Better be prepared

Thanks
@seth & @cryptearth

dimich

Member

From: Kharkiv, Ukraine

Registered: 2009-11-03

Posts: 846

Re: [SOLVED] SSH Tunneling/Forwarding With Intermediate Server

[c@c ~]$ ssh -L 8080:localhost:8080 b@b
[b@b ~]$ ssh -L 8080:localhost:8080 a@a

If I understand the setup correctly, this can be done with single command:

[c@c ~]$ ssh -J b@b -L 8080:localhost:8080 a@a

arch_fuz

Member

Registered: 2015-01-31

Posts: 61

Re: [SOLVED] SSH Tunneling/Forwarding With Intermediate Server

[c@c ~]$ ssh -J b@b -L 8080:localhost:8080 a@a

Even better, I'll try this.

Stay save and strong, my ukrainian friend!
God bless you.

cryptearth

Member

Registered: 2024-02-03

Posts: 2,409

Re: [SOLVED] SSH Tunneling/Forwarding With Intermediate Server

@dimich
I actually don't know how -J actually works to give a definite yes or no - but i guess in this case it's ok

from what i understand: the difference between chaining like i do and a jump connection is layering: while the chain first opens just a connection to the intermediary host and then a new one from the intermediary to the final host to jump connection seems somewhat like an onion tunnel: the intermediary host can not see inside the tunnel that's established from the client to the final host - somewhat like this:

client + ===22=== + intermediary + ===22=== + final host
       + ==8080== +              + ==8080== +

client + ===22=== - intermediary - ===22=== + final host
       + ===============8080=============== +

while with regular chaining the 8080 connection is "terminated" at the intermediary host and then "routed" via another connection - while with the jump it's a tunnel all the way thru - but i could be wrong nor do i know if this makes any difference how the final host sees the endpoint

if my assumption is correct then i guess it comes down to if you trust the intermediary jump proxy
in my case, as i control all of my machines, for me it doesn't make any difference if my home server sniffs on the traffic to my root - but if the intermediary is controlled by someone else and just provides you a public endpoint it may be adviced to use a tunneled setup via the -J option

Last edited by cryptearth (Yesterday 21:12:38)

dimich

Member

From: Kharkiv, Ukraine

Registered: 2009-11-03

Posts: 846

Re: [SOLVED] SSH Tunneling/Forwarding With Intermediate Server

if my assumption is correct then i guess it comes down to if you trust the intermediary jump proxy

That's right, your assumption about layering is correct. However, apart of trust, there are some other technical differences. For example, with chaining you have four TCP connections on intermediate host: two for ssh and two for port forwarding, allocating port 8080 (or whatever number, but potentially conflicting) and one other ephemeral port. With jump you have only two TCP connections. Of course, in most cases difference in performance and resource usage is negligible, but it does exist.
Also convenience: one command run on one machine is just simpler    

Stay save and strong, my ukrainian friend!
God bless you.

Thank you! You too.