Re: VPN - TYPE SERVER SUPPORT VIA SSH

From: Kimmo Koivisto (kimmo.koivisto_at_surfeu.fi)
Date: 03/28/05 

Date: Mon, 28 Mar 2005 21:20:42 +0300

sed wrote:

> Here is what I am trying to achieve with ssh, does anyone have any
> ideas or insights that might help me find a solution for the following:
>
> I have a have a server(linux rh enterprise) located at a customer site
> that I must support that uses an intranet web like application. My
> requirements for support are shell access, file transfer, and the
> ability to run the application(http) for testing. I have no access to
> the firewall between the server and the internet and cannot setup an
> incoming vpn rule.
>
> I had the idea of somehow using ssh from the server behind the firewall
> out to our office server and with some port forwarding configuration,
> then be able to make this work somewhat like a vpn to make this
> customer server accessible to our home office for the protocols
> above(shell(ssh or telnet..etc, file transfer(sftp maybe), and http. I
> want this connection to be secure of course. But the trick here is to
> let the customer server initiate the connection outbound(which I think
> will not require any remote firewall changes). This seems to me to be
> workable. Any suggestions?

Well, ssh with remote forwarded ports should work. You could combine autossh
to this, so the connection always stays up. You could use VPN too, just
force nat-traversal (so only UDP is used) and start the connection from
customer.

But with ssh, from customer server to your office ssh-server, forward port
2080 to customer port 80, forward port 2022 to customer port 22

#ssh -l username office-ssh-server -g -R 2080:customer-server:80 -R
2022:customer-server:22

After this, you should be able to connect from your office to your office
ssh-server port 2080 and be forwarded to the customer server.

Verify the options from manual, I'm not sure about those :)

Regards
Kimmo Koivisto

Relevant Pages

  • Re: OpenSSH 3.4p1 port forwarding problem
    ... > I am attempting to setup port forwarding of port 1680 over the SSH ... The connection has been closed." ... > debug: Entering interactive session. ...
    (comp.unix.sco.misc)
  • port forwarding source address
    ... The SSH encrypted connection itself can be bound to a specific IP address ... Port forwarding can bind to a specific address on the listening host, ...
    (comp.security.ssh)
  • Re: Load estimation - SSH on HP-UX
    ... > perform port forwarding only. ... Run one SSH session per forwarded connection. ... One a single SSH session with a large number of forwarded connections. ... B1) There's a sanity-check limit of the number of port forwards of 100 ...
    (comp.security.ssh)
  • Re: Is there a risk with firewalls?
    ... if the router assigns IP adresses ... Or if he saw an FTP connection and read a PORT command, ... setup the appropriate forwarding. ...
    (comp.security.firewalls)
  • Re: VPN connection problem using NTL
    ... forwarding - it wasn't necessary. ... VPN connection from home across their NTL cable broadband connection. ... We have tried both a Linksys and Netgear router and have setup port ...
    (uk.telecom.broadband)