2

I'm trying to establish a SSH tunnel to allow VNC/ARD connections (ports 5900 and 3389). However I'm uncertain about a certain thing:

Let's say machine A has IP 192.168.103.1 and has services running on ports 5900 and 3389.

I want to SSH to the server that has IP 192.168.103.254.

Machine B 192.168.103.2 wants to connect to machine A by using an tunnel on the server 192.168.103.254 and different ports (let's say 6001 and 4001)

So, the setup will look like this:

Machine B 192.168.103.2 --> VNC to Server 192.168.103.254:6001 (Server redirect --> 192.168.103.1:5900)

I know a little bit about SSH tunnel and reverse SSH tunneling but I'm unsure which command I need.

Please note:

  • The Client PC has to connect to the server (the other way around is not possible since the clients have different IP addresses everytime)

Things I tried:

ssh -f [email protected] -L 6001:localhost:5900 -N

This command succeeds but when I try to connect to it I get a connection refused error:

Tims-Macbook-Pro:~ Tim$ telnet server.hostname.net 6001
Trying 192.168.103.254...
telnet: connect to address 192.168.103.254: Connection refused
telnet: Unable to connect to remote host

I also tried this

sudo ssh -NT -R 6001:localhost:5900 [email protected]

The command also gives a connection refused error when I'm trying to access it.

Tims-Macbook-Pro:~ Tim$ telnet server.hostname.net 6001
Trying 192.168.103.254...
telnet: connect to address 192.168.103.254: Connection refused
telnet: Unable to connect to remote host
1
  • What have you tried? Anything? Give us the commands you tried, what you expected to happen, and what actually happened. As it is, you're asking for us to spoon-feed you a solution, which would be very un-professional of us to do.
    – EEAA
    Feb 12, 2014 at 14:26

2 Answers 2

2

You should reach Machine A's port 5900 when connecting to the server's localhost port 6001 with this command:

ssh -L 6001:192.168.103.1:5900 [email protected]

Check this resource for a deeper understanding of SSH tunneling: http://www.linuxhorizon.ro/ssh-tunnel.html

UPDATE:

If you need multiple clients accessing Machine A's port 5900 via the server like this:

Client1
Client2 ---> port 6001 ---> 192.168.103.254 ---> port 5900 --> 192.168.103.1
Client3

You need to run this command (In the client):

ssh -L 0.0.0.0:6001:192.168.103.1:5900 [email protected]

All clients connecting to the server port 6001 will reach Machine A's port 5900 with that command.

6
  • This works for the server itself but other clients can't use telnet 192.168.103.254 6001 because the connection gets refused: telnet: connect to address 192.168.1.254 Connection refused
    – Timothy
    Feb 12, 2014 at 17:21
  • At first I thought this worked but I had to enter the commands on the server, which I can't like I said in my first post The Client PC has to connect to the server (the other way around is not possible since the clients have different IP addresses everytime)
    – Timothy
    Feb 12, 2014 at 18:13
  • You mean, you need to be able to open the ssh tunnel from the client? Feb 12, 2014 at 18:15
  • Yes, that's what I'm trying to do. Of course I could write a script that executes the above SSH command on the server but isn't there a better way to do this?
    – Timothy
    Feb 12, 2014 at 19:10
  • Hmm.. I've never tried this, buy it may work, from the client, run: ssh user@server 'ssh -L 0.0.0.0:6001:192.168.103.1:5900 [email protected]'. That is going to run an ssh command via ssh. Replace user@server according to your needs. Feb 12, 2014 at 19:13
0

You try to connect to your "gateway" server but we don't know if that kind of traffic is allowed. Your best bet is to try mapping the remote port to a local port, as you did in the first example, but you need to actually point to the server you want to connect to, like this:

ssh -f [email protected] -L 6001:192.168.103.1:5900 -N

If not, how would ssh know which IP needs to forward the connection to? By doing this you are mapping port 5900 of the remote server 192.168.103.1 to a LOCAL (your machine) port (6001 in this case) through a SSH tunnel via server.hostname.net.

Now, to connect you just access a local port:

telnet localhost 6001
2
  • I executed ssh -f [email protected] -L 6001:192.168.103.1:5900 -N on my client (machine A) and then tried the following command on machine B telnet 192.168.103.254 6001 however I'm still getting telnet: connect to address 192.168.103.254: Connection refused
    – Timothy
    Feb 12, 2014 at 17:09
  • You are mapping a port from a remote machine to a local port in your own machine. That's why you should do the telnet to localhost: telnet localhost 6001.
    – Migtor
    Feb 25, 2014 at 19:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .