Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

First of all, I'll describe a model of a networking infrastructure which I'll use as an example to explain what I'm looking for. It's very simple:

                                /-------> [PC2: IP]
[PC1: IP] --> (internet)
                                \-------> [PC3: IP]

I'm searching for an application or a combination of a few ones which could implement the following logic:

1) there must be a daemon D1 running on PC1@; this daemon must have a mechanism to specify a configuration which could be logically translated to something as follows:

ports: <a set of ports> /* example: 80, 8080, 3306, 3000-3100 */
target IP: <a remote IP> /* */
target port: <port> or KEEP_ORIGINAL  /* example: 5555 */
through port: <port> /* example: 80 */

2) there must be a daemon D2 running on PC2@; from the above example it must use port 80 to listen for incoming connections; it could have a configuration like this:

listen port: 80

3) D1 acts as a client in relation to D2, D2 also will act as a client to proxy the connections

How must it work: The daemon on PC1 must be listening for incomming connections on the specified ports ("ports" from config, a set of ports, better if ranges could be specified). Every connection must pe processed in such a way that it will be passed to the "target IP" (from above: machine through "through port" (from above: 80). Now PC2 must handle these connections and act as a proxy depending on "target port" setting of the client; if there is a port, daemon on PC2 must connect to its specified "backend" using this port; if there is specified KEEP_ORIGINAL, daemon on PC2 must connect to "backend" using the original port.

Example (using the above config): a MySQL client running on connects to "localhost" on port 3306; D1 has 3306 as a listening port and it processes it, D1 initiates a connection to and announces D2 that D2 must use port 5555 when connecting to its "backend"; D1 tunnels this connection to D2; D2 initiates a connection to and acts as if it is the original MySQL client; as a logical consequence on must be a running MySQL server on port 5555. If D1 uses KEEP_ORIGINAL, D2 must initiate a connection using the same port, i.e. 3306 in this case.

Shortly, the main idea is to concentrate a bunch of connections to different ports, tunnel them through a single connection to a daemon which will act as the original clients, with the possibility to keep the original ports. Better if this tunneling could be chained through multiple intermediates and the final point will act as the original initiator. And even better if all these intermediate connections could be secure.

Now I'm using "crossroads" and "putty" and theoretically it's possible to organize an infrastructure satisfying at least some partial requirements, but probably there are some wrappers or other specialized applications for this purpose and you could help by recomending one or advising what to do. So, what software must I use to implement the described logic?

The OS is not so important, better if it's some sort of Linux.

A second, not so important question: what could be used instead of "crossroads" ( http://crossroads.e-tunity.com/ ) with the same features (interested only in TCP proxy, no balancing or HTTP specific)?


@Chopper3: On PC3 there are running a lot (tens) of custom services and applications. Some applications use fixed ports from a range, others use random ports also from a range. PC3 can be accessed only by PC2, PC2 can be accessed from outside but there is a firewall and only a few ports are open (as I understand, tunneling is required in this case). PC1 must connect to PC3, but it must look as PC2 is initiating these connections (PC3 must not be aware of PC1). For fixed-ports services I can do it, but I'm not able to handle variable and random port scenarios. Also for port ranges I have to add them one by one.

share|improve this question
Holy crow, wouldn't it be much easier to set up a site-to-site VPN and be able to address your entire internal network without any fancy port forwarding? Keep things simple. –  MikeyB Jul 22 '11 at 15:55
I have the feeling you are trying to somehow circumvent a restriction imposed in your network, but I am not sure as your question is just too convoluted. –  SvW Jul 22 '11 at 15:57
Can you please explain what you're trying to actually achieve, nothing technical but what you're trying to do. –  Chopper3 Jul 22 '11 at 15:59
Without VPN. The main requirement it must act as a proxy. PC3 must think it is accessed by PC2 without knowing of PC1 and it must be flexible with ports. –  Art84 Jul 22 '11 at 16:01
I have no idea what you're trying to achieve, but I'm willing to bet that you're doin' it wrong. –  womble Jul 22 '11 at 23:23

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.