Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This example is related to MongoDB but the core issue is with SSH tunneling, MongoDB stuff should add value though

Hi,

I'm attempting to bring up a local MongoDB node which is part of a ReplicaSet based in a data-centre. TCP/IP will be tunneled over SSH from local to data-centre.

All boxes, local and data-centre, are running CentOS.

This works fine when creating a tunnel on data-centre box1 to local node using:

ssh -v -4 -f -N -o TCPKeepAlive=no -o ServerAliveInterval=15 -L27017:127.0.0.1:27017 -g a_user@server_i_have_ssh_access_to

box1 can access the local node Mongo shell with command (cmd 1):

mongo --host localhost --port 27017

box2 can also access the local node Mongo shell with command (cmd 2):

mongo --host box1 --port 27017

box2 in the data-centre can also connect to the box1:27017, the forwarded port of my local node.

however, it would be much preferable, simpler, and should be possible to setup a reverse forward between local node and box1 on the same ports as above. Using the command:

ssh -v -4 -f -N -o TCPKeepAlive=no -o ServerAliveInterval=15 -R27017:127.0.0.1:27017 -g a_user@box1

now i can connect from box1 to local node using cmd 1 above, however, cmd 2 fails with:

Error: couldn't connect to server box1:27017} (anon):1139 exception: connect failed

Any ideas?

share|improve this question

2 Answers 2

up vote 2 down vote accepted

By default -R only listens on the loopback interface (the default for -L is all interfaces). Hence cmd1 works because it is being run locally on box1 but cmd2 fails because it is being run on box2. The fix is to change -R to one of:

-R:27017:127.0.0.1:27017
-R'*:27017:127.0.0.1:27017'
share|improve this answer

All I can think of is TCP Wrappers or some other authentication is failing. Anything in /var/log/auth.log if it's a Debian-based OS or similar ?

share|improve this answer
    
Thanks. I'm using CentOS.The equivalent log is located at /var/log/secure, and there are no related messages in this log on any of the related machines. –  norm Mar 28 '11 at 15:21

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.