Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have several machines on my lan. One is used as a http proxy to target web sites located on the others (that's working fine now thanks to ServerFault). On my router, Port 22 is NATed to this proxy machine. I would like to be able to access the other machines, within internet, with something like:

ssh user@first_machine.my_domain.tld ssh user@second_machine.my_domain.tld

Could I use the proxy machine to 'filter' the incoming ssh request and to route them to the correct machine ? (in the same way it's possible to do so for web sites using a mix of mod_proxy and namevirtualhost in Apache)

Thanks a lot, Luc

share|improve this question

5 Answers 5

I would look at just connecting to your proxy box or some other host, then use the GNU screen utility to have multiple sessions running to your other boxes.

As a bonus, you'll learn how to use screen, which is fantastic application that everyone should know more about!

share|improve this answer
    
That's an interesting utility I do not know yet. Thanks, I will check this. –  Luc Mar 23 '10 at 12:45

Other people made good suggestions, but I think that the simplest and most flexible answer was already contained in your question when you gave a sample command. That is, if we have a source host, an intermediate host, and a destination host; and since ssh can execute commands on a remote host for us, you can run this command from the source host:

ssh -t $intermediate ssh $destination

Of course, you can add other options as needed to either ssh command, or write a shell wrapper (script, alias, function) to handle any variables. The -t flag forces the allocation of a pseudo-tty, which I think is necessary, but you can test connecting without it to make sure. Also, if you create public/private key pairs for each host in the chain, and use ssh-agent, you can avoid typing passwords.

share|improve this answer
    
I've never used this command, but I think this can be very helpfull for my needs. Thanks, I know have a panel of several possible solutions !!! That's great –  Luc Mar 23 '10 at 12:46

You can set this up in your .ssh/config file to configure a tunnel automatically

http://backdrift.org/transparent-proxy-with-ssh

basically you just add something like

Host machinebehindrouter
ProxyCommand  ssh user@externalhost nc %h %p
share|improve this answer
    
Thanks, this is what I was looking for. –  Luc Mar 21 '10 at 20:41

You could use a VPN to connect to the remote network first, and then directly connect via SSH. This may or may not be possible, may or may not be what you want to achieve in the first place, but it will work.

I heavily recommend you expose as few as possible machines to the internet via port mapping! Especially if password/keyboard interactive authentication is allowed. People do have weak passwords.

Another suggestion might be to connect to your proxy machine and have it explicitly build tunnels to each and every machine you want to directly reach behind your NAT. You can either specify one (or more) SSH tunnels directly from the command line like this:

ssh -L localport:hostnameOrIPofMachineBehindNAT:remoteMachinePort yourusername@proxy.example.com

Where localport ist the port number you need to connect on your localhost that will be forwarded to the machine behind NAT, SSH tunneled through your proxy.

hostnameOrIPofMachineBehindNAT is the LAN IP or LAN DNS of the non-proxy machine you want to reach behind NAT. Often in a private IP Range like 10/8, 192.168/16 or 172.16/12.

remoteMachinePort is the port number of the service you want to connect to on the remote machine behind NAT. In case of SSH it is likely that this will be the standard port 22.

yourusername@proxy.example.com is trivial I guess.

You can then connect to your other machine like this from another local shell:

ssh usernameOnRemoteBoxBehindNat@localhost

Since a command line can easily get very long an tedious to type, it is way better to stuff all this, with as many SSH options you want, and as many port tunnelings you like into your ~/.ssh/.ssh_config file. This will reduce your typing to ssh connectionNickname and always have all the forwardings and options set automatically.

See man 5 ssh_config for an in depth explanation and list of config options you can use in ~/.ssh/.ssh_config.

share|improve this answer
    
Thanks for your explanation, I think the last part will match my needs. Regards, Luc –  Luc Mar 21 '10 at 20:42
  • You can ssh to one machine first, then ssh from that machine to the others. Maybe use ssh-keys to make login easier.
  • Or you can change the port on each machine and NAT it properly.

I would go with first option and secure the other machines to only allow ssh from the first machine.

share|improve this answer
    
Hello, in fact this is what I'm doing now but I just wondered if there was no some kind of process within ssh which could analyse the targeted server name and forward to the correct machine automatically. That would be great.... Well, I guess there are some reasons behind that. Thanks a lot, Luc –  Luc Mar 21 '10 at 13:56
    
why are you letting ssh into your network in the first place? I'd should use a vpn and ssh! –  The Unix Janitor Mar 21 '10 at 14:24
    
well, this is just to access my local network at home. I do not really need a VPN for this, but you're right that may be an option. –  Luc Mar 21 '10 at 20:36

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.