Help me understand tunneling before I set it up

alaios · 10-16-2013, 08:23 PM

Dear all,
I will need your help to understand what ssh tunneling can offer. I have to introduce three terms first

home computer, the one I use to connect remotely to my working computer
work computer, where all my work is done during the day
gateway, a computer in our work that we have to connect through to gives us access to the work"s lan. I just care for the work computer.

In my work computer I have set up my ssh and nx to answer to port 5903 which I need your help to connect to.

That means that I would need first to go through the gateway. Gateway is running linux and it supports tunneling.

Now I need your help to understand the concept of tunneling and what should I do to my home computer to be able to reach the port 5903 of my work computer.

I would like to thank you in advance for your reply

Regards
Alex

evo2 · 10-16-2013, 09:33 PM

Hi,

there are two common ways of doing this. I'll use your home, work, and gateway definitions here.

1. Set up a local tunnel using "ssh -L".
This makesd some high numbered port on your home machine forward to the sshd port on your work machine via a connection to the gateway. Then you ssh to that port on the home machine and the connection will go to the work machine.

Set up the tunnel. On home run:

Code:

ssh -t -L 9999:work:5903 gateway

This will create the tunnel and give you a terminal on the gateway machine.
Next, open a new terminal on home and run

Code:

ssh -p 9999 localhost

This will give you a shell on work.

2. Using proxycommand.
This is by far my preferred method. Basically you tell ssh how to hop from one machine to the next by putting some directives in your ~/.ssh/config
So you would add the following to ~/.ssh/config on home.

Code:

Host work
   ProxyCommand ssh -qax -W %h:%p gateway
   Port 5903

Thats it. Now you can just "ssh work" from home.

Code:

ssh work

I think this method is far superior. You don't have to explicitly set up (and maintain) tunnels, you don't have to use some strange incantation (ie "ssh -p 9999 localhost") when you want to ssh to work, it works transparently with scp, rsync, sshfs etc.
Note also that if you have different usernames on the different machines you can also put them in the .ssh/config to save you needing to type that. For example if on home your username is alaios but at work you are alex, you can make your .ssh/config look like

Code:

Host gateway
   User alex
Host work
   User alex
   ProxyCommand ssh -qax -W %h:%p gateway
   Port 5903

HTH,

Evo2.

alaios · 10-17-2013, 11:00 AM

Quote:

Originally Posted by evo2

Hi,

there are two common ways of doing this. I'll use your home, work, and gateway definitions here.

1. Set up a local tunnel using "ssh -L".
This makesd some high numbered port on your home machine forward to the sshd port on your work machine via a connection to the gateway. Then you ssh to that port on the home machine and the connection will go to the work machine.

Set up the tunnel. On home run:

Code:

ssh -t -L 9999:work:5903 gateway

This will create the tunnel and give you a terminal on the gateway machine.
Next, open a new terminal on home and run

Code:

ssh -p 9999 localhost

This will give you a shell on work.

Hi
the first method actually worked and I am happy to get a console. I was also able to launch nx client that is running on the correct port.
I am only worried now how I can also forward -X through the gate, so once I am connected to my work computer to be able to launch X commands.
Would that be also possible?

Regards
Alex

evo2 · 10-17-2013, 08:48 PM

Hi,

Quote:

Originally Posted by alaios

the first method actually worked and I am happy to get a console. I was also able to launch nx client that is running on the correct port.

If your nx client has native socks support you may be interested in using a socks proxy from the -D ssh option.

Quote:

I am only worried now how I can also forward -X through the gate, so once I am connected to my work computer to be able to launch X commands.
Would that be also possible?

Why "worry"? Go ahead and test it. :-) Note also, that instead of typing "-X" every time you might instead want to use "ForwardX11 yes" in your ~/.ssh/config

Cheers,

Evo2.