I have several machines that I manage that are behind firewalls which restrict which hosts can SSH into the network. For the most part this is not a problem as I typically have a static IP when I'm at home or in the office, but causes me no end of trouble when I'm on a remote network somewhere else. My solution was to simplify the forwarding through one of my hosts with a static IP allowed through the firewall using the
ProxyCommand in my SSH client configuration. This works for me using OpenSSH, and should work with other SSH clients which support the
ProxyCommand so check your client documentation if in doubt. It also requires the installation of
netcat the TCP/IP swiss army knife.
Inside my ~/.ssh/config file I have the following configuration:
ProxyCommand ssh StaticHost nc %h 22
I use the short hostname to reference the configuration, allowing me to use the fully qualified domain name to reach it without using the forwarding. What this configuration does is connect to StaticHost and run netcat to forward to InternalHost-FQDN on port 22. Unless you have your SSH identity key setup to log into StaticHost & InternalHost without prompting for the password you will receive two prompts for your password entry. In my case I have my SSH identity key installed on both and load the SSH key into the SSH agent and find myself logged in without any password request prompts.
This configuration will also work to allow you to transfer files back and forth with InternalHost using the
scp command just as easily as logging into the shell.