Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I hope someone can follow this and I'll explain as best I can.

I'm trying to forward all traffic from port 6999 on x.x.x.224, through an ssh tunnel, and onto port 7000 on x.x.x.218.

Here is some ASCII art:

|browser|-----|Squid on x.x.x.224|------|ssh tunnel|------<satellite link>-----|Squid on x.x.x.218|-----|www|
         3128                      6999                          7000                                80

When I remove the ssh tunnel, everything works fine.

The idea is to turn off encryption on the ssh tunnel (to save bandwidth) and turn on maximum compression (to save more bandwidth). This is because it's a satellite link.

Here's the ssh tunnel I've been using:

ssh -C -f -C -o CompressionLevel=9 -o Cipher=none eamorr@172.16.1.224 -L 7000:172.16.1.224:6999 -N

The trouble is, I don't know how to get data from Squid on x.x.x.224 into the ssh tunnel? Am I going about this the wrong way? Should I create an ssh tunnel on x.x.x.218? I use iptables to stop squid on x.x.x.224 from reading port 80, but to feed from port 6999 instead (i.e. via the ssh tunnel). Do I need another iptables rule?

Any comments greatly appreciated.

Many thanks in advance,


Regarding Eduardo Ivanec's question, here is a netstat -i any port 7000 -nn dump from x.x.x.218:

14:42:15.386462 IP 172.16.1.224.40006 > 172.16.1.218.7000: Flags [S], seq 2804513708, win 14600, options [mss 1460,sackOK,TS val 86702647 ecr 0,nop,wscale 4], length 0
14:42:15.386690 IP 172.16.1.218.7000 > 172.16.1.224.40006: Flags [R.], seq 0, ack 2804513709, win 0, length 0

Update 2:

When I run the second command, I get the following error in my browser:

ERROR
The requested URL could not be retrieved

The following error was encountered while trying to retrieve the URL: http://109.123.109.205/index.php

Zero Sized Reply

Squid did not receive any data for this request.

Your cache administrator is webmaster.


Generated Fri, 01 Jul 2011 16:06:06 GMT by remote-site (squid/2.7.STABLE9)

remote-site is 172.16.1.224

When I do a tcpdump -i any port 7000 -nn

I get the following:

root@remote-site:~# tcpdump -i any port 7000 -nn  
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode 
listening on any, link-type LINUX_SLL (Linux cooked), capture size 65535 bytes 
channel 2: open failed: connect failed: Connection refused 
channel 2: open failed: connect failed: Connection refused 
channel 2: open failed: connect failed: Connection refused 
channel 2: open failed: connect failed: Connection refused 
channel 2: open failed: connect failed: Connection refused 
channel 2: open failed: connect failed: Connection refused 
channel 2: open failed: connect failed: Connection refused 
channel 2: open failed: connect failed: Connection refused 
channel 2: open failed: connect failed: Connection refused
channel 2: open failed: connect failed: Connection refused 
channel 2: open failed: connect failed: Connection refused
share|improve this question

1 Answer 1

If I understood you correctly there's something wrong with your tunnel definition. What you seem to be doing with your current command line is to forward traffic from port 7000 on the current host (I assume it's .224) to port 6999 on .224 itself.

Try this instead:

ssh -N -g -f -C -o CompressionLevel=9 -o Cipher=none eamorr@172.16.1.224 -L 6999:172.16.1.218:7000

Or, if 172.16.1.218:7000 is not directly reachable (I'm guessing it isn't, as you would probably connect to it directly otherwise) you probably mean to connect to 172.16.1.218 instead:

ssh -N -g -f -C -o CompressionLevel=9 -o Cipher=none eamorr@172.16.1.218 -L 6999:localhost:7000

The format for -L is <localport>:<remotehost>:<remoteport>. <remotehost> is relative to the destination host, so in this case localhost should work.

Note I added -g in case you want to use the tunnel from a machine different than .224 (I'm assuming you're running ssh on .224).

share|improve this answer
    
Hi, thank you so much for your answer. Yes, I'm running ssh on .224. I ran your command. It's definitely doing something as I can see traffic on port 7000 of x.x.x.218 (I should add that I have a shorewall rule to forward traffic from port 7000 of .224 to port 7000 of .218). I can see the traffic using the netstat -i any port 7000 -nn on machine x.x.x.224 An example of the output is appended to the OP. Many thanks! Any more suggestions greatly appreciated. –  Eamorr Jul 1 '11 at 13:44
    
Hi, I tried your second command: bind: Address already in use channel_setup_fwd_listener: cannot listen to port: 6999 Could not request local forwarding. –  Eamorr Jul 1 '11 at 13:49
    
Sorry, forget last comment. It was due to some zombie ssh tunnels running which I forgot to kill ;*( –  Eamorr Jul 1 '11 at 14:07
    
Hi Eduardo, I was wondering if you had any more suggestions to get rid of these "cannot listen to port" errors? Many thanks –  Eamorr Jul 1 '11 at 15:00
    
Hi Eamorr - are you running only one of the command lines, right? You can't run both. You probably need only the second one. –  Eduardo Ivanec Jul 1 '11 at 16:03

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.