Re: OpenSSH remote port forwarding

From: Brian (brian@bmonte.com)
Date: 01/11/02 

From: "Brian" <brian@bmonte.com>
Date: Fri, 11 Jan 2002 09:41:57 -0500

"Marco Spizzichino" <marco@starfarm.it> wrote in message
news:a1ml79$37o$1@shale.ftech.net...
> Hi,
>
> I have an ADSL connection with an ISP. I have neither access nor control
> over their Router / Firewall so I cannot open/close ports as I'd like. My
> internal network is NAT so it is not publicly available. It does not seem
to
> have any limit in the ports I can use to go out on the Internet. I believe
> the client access from my NAT network is not limited at all... So I can,
for
> example, use an outgoing SSH connection from here to the Internet...

Is this your home machine?

What ADSL Provider are you using?

>
> Somewhere else I have a server on the Internet with a publicly available
> static IP address. Incoming SSH it is possible and it is working.
>
> Now the question:
>
> I read many docs on the OpenSSH port forwarding (both Remote and Local),
so
> I was trying to configure my two systems to "enable" a special ssh tunnel
> from my public machine to my "hidden / NATed" ADSL connected workstation.
>
> It is always possible for me to start a manual or automatic SSH connection
> from my NAT network to my public machine.
>
> Once the SSH client connection from the ADSL machine to the Internet one
is
> done, I would like to "reverse" and log into the ADSL machine from the
> Internet one...
>
> I've tried something like (adsl-machine is the hostname of the NAT
machine,
> public-server is the name of the Internet machine)
>
> [root@adsl-machine]# ssh -R 2022:localhost:22 root@public-machine
>
> (this command should open an ssh connection to public-machine and there,
by
> listening on port 2022, creates a tunnel over ssh to the port 22 of the
> adsl-machine... right ?!?)
>
> After the command, and the login, I am sitting on the public-machine,
logged
> in as root and I can see using "netstat -ta" that there is an entry that
> says:
>
> tcp 0 0 localhost:2022 *:* LISTEN
>
> That makes me think that SSH is really listening on port 2022... OK, let's
> go further:
>
> [user@public-machine]$ ssh localhost -p 2022
>
> (this command should connect to the local port 2022 using ssh - actually
> should be connecting to the adsl-machine port 22 on the other end of the
> tunnel - right!?)
>
> Well, it does not work... :-)

Your setup above sounds fine to me but the problem is you do not have
access to your router or firewall which may be blocking your
ports.

For instance, I have Ameritech DSL at home with a Linksys Router.
I have forwarded my port XXXX to my machine inside the
Linksys router which stays on all the time so I can keep the public
addresss.

When I ssh from my work system, I SSH to the public IP address
and the Linksys router port forwards to my local machine and I
can get connected.

>From my understanding you have to access the public IP address
of the router which should port forward to your ssh machine.

If someone else knows a better way, I am willing to listen.

>
> What am I missing ?
>
> Regards,
>
> Marco
>
> PS: Note that if I use the local port forwarding (-L) feature trying to
tie
> adsl-machine local port 2022 to the remote port 22 of the public-machine,
> everything is fine and I can successfully connect to the remote
> public-machine using "ssh localhost -p 2022" ...
>
> Help! :-)

Brian

Relevant Pages

  • UPDATE: Re: Question regarding SSH via Lantronix SCS100
    ... to do SSH and to authenticate the SSH connection with a local ... unexpectedly closed connection'. ... CONSOLE or AUX port on the router, or does it matter, and what ...
    (comp.dcom.sys.cisco)
  • Re: SSH options re: NAT
    ... No, SSH is two-fold, a call to it on the client side results in a call ... port, meaning that any connections that come into that port are answered ... programming practice for daemons) Once the connection is established, ... don't want to execute a command on the remote side and you use -N. ...
    (comp.security.ssh)
  • Re: SFTP
    ... > avoid port transient net devices dropping port 22 ... Port 21 is allocated for FTP, not SSH. ... SSH connection. ... Do not get it mixed up with FTPS. ...
    (SSH)
  • Re: SSH tunneling/port forwarding and stateful packet inspection
    ... > have reconfigured SSH to run over port 443 the trace shows it as SSL ... Your packet trace identifies the TCP connection as ...
    (comp.security.ssh)
  • OpenSSH remote port forwarding
    ... I have an ADSL connection with an ISP. ... Incoming SSH it is possible and it is working. ... I read many docs on the OpenSSH port forwarding, ... After the command, and the login, I am sitting on the public-machine, logged ...
    (comp.security.ssh)