Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm working at home.

I need to access machines which are in the office. The office has a private LAN (e.g. 192.168.0.0/16) with 100 machines on it. I would like to be able to access these machines from home.

We have one SSH bastion (SSH gateway) host available at gateway.example.org, and we can use this for SSH tunnels.

Here's what I want to do:

  1. SSH from home to gateway.example.org . Somehow, I need to set up the appropriate tunnel (SSH tunnel, SOCKS proxy, etc.)
  2. If the request is for an IP on the 192.168.0.0/16, then force it through a tunnel or a proxy.
  3. If the requested IP does not match the 192.168.0.0/16 network, then don't use a proxy. Some people use ssh to tunnel all TCP traffic. But I only want to proxy requests to the 192.168.0.0/16 network.

Can I use SSH forwarding or a proxy to do this?

I can use a SOCKS proxy with SSH Dynamic Port Forwarding with OpenSSH on Linux/Unix (PuTTY supports similar functionality):

ssh -v -D 3333  gateway.example.org.

But this just works for the webbrowser and a few other SOCKS-aware applications.

I would like to force some other traffic (VNC ports 5900/5901) through a proxy as well. In particular, I'm trying to figure out how to get Dell DRAC and the application and a Supermicro IPMI KVM-over-LAN to work over this SSH tunnel.

I am currently using a Mac (Snow Leopard) laptop, although I'm looking for a more general networking concept which will work on multiple operating systems.

share|improve this question
    
Is there a reason why you can't set up a VPN or SSH at the office itself? –  John Gardeniers Sep 17 '11 at 2:51
    
@John : I've simplified my example. In reality, there are a couple distinct sites where we would like this functionality. Other admins own the hardware, and installing a VPN isn't always politically desirable. However, each of these sites supports SSH, so maybe SSH tunneling is a possible alternative. –  Stefan Lasiewski Sep 17 '11 at 3:34

2 Answers 2

up vote 1 down vote accepted

I use a combination of dynamic port forwarding and a smart proxy.

ssh -D 12345 me@work

This will set up a SOCKS proxy that listens on your local machine on port 12345, and it proxies traffic over to your work network.

Then install "FoxyProxy" on Firefox. FoxyProxy has rules to allow it to decide whether to send an HTTP request directly to the destination, or to send it through a proxy.

You want to run vnc through the tunnel. Some viewers like xvncviewer have a "-via" option, which will open their own SSH tunnel just for that session. Or you could run the vnc viewer through a program like "tsocks", which will use the 12345 tunnel that we set up above.

share|improve this answer

I'm looking for a more general networking concept which will work on multiple operating systems.

The more generic option would be just to setup a VPN. There are many different VPN technologies. I strongly prefer OpenVPN.

There are ways to build a VPN over SSH, but that doesn't perform that well, and most methods tend to take a lot of obscure configuration, the methods will not be cross platform.

share|improve this answer
    
I agree that a VPN would be much better. I am hoping to find a workable SSH alternative, for the cases where I don't control the SSH bastion host. –  Stefan Lasiewski Sep 17 '11 at 0:48

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.