Home / server / Questions / 97378
In Process
Jon Haddad
Asked: 2009-12-25 10:48:30 +0800 CST

SSH Tunneling to box behind firewall

  • 772

I've got a computer behind a firewall, a home desktop, and a server. I can reverse ssh tunnel to the server from computer_behind_firewall, and then 

ssh  localhost -p some_port

while on the server, but it doesn't work if I try to 

ssh my_server -p some_port

from home. I've disabled iptables to make sure it's not a firewall issue, and that hasn't helped.

What do I need to make my Ménage à trois of servers work out?

Ideally I'd like to port forward http on certain requests to the machine behind the firewall.

linux

3 Answers

  1. From the SSH documentation on Port Forwarding:

    It is important to realize that if you have three hosts, client, sshdserver, and appserver, and you forward the traffic coming to the client's port x to the appserver's port y, only the connection between the client and sshdserver will be secured. See Figure Forwarding to a third host. The command you use would be something like the following:

    ssh2 -L x:appserver:y username@sshdserver

    alt text
    (source: ssh.com)

    • 2

  2. If you already have a reverse ssh tunnel with the server, you're probably looking for "-g" option.

    -g      Allows remote hosts to connect to local forwarded ports.

    Otherwise only localhost will be allowed to use your tunnel.

    • 2

  3. I don't quite get your question or rather, what the problem is and what you want to achieve. Also, this is not a coding question, but I'll try to dig into it.

    Do you want to tunnel TCP connections through SSH to computer_behind_firewall through the server from outside the firewall? And this SSH connection to server fails? If so, you should run tcpdump tcp PORT on the server to see if really no packets arrive. If they arrive, your sshd or TCP wrapper are configured to not accept connections from outside (check /etc/ssh/sshd_config, /etc/hosts.deny and /etc/hosts.allow). Also look into the logfiles in /var/log. If no packets arrive, there is a firewall either at the sending end or on the gateway to the LAN of the server that is blocking or not forwarding into the private network.

    • 0