Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have googled and haven`t found the answer on my question. Help me please. There are two servers:

serverA with public IP 12.0.0.10 and an private IP 10.0.0.5
serverB with public IP 20.0.0.11

I have setup SOCKS proxy on serverB to serverA:

ssh -D20.0.0.11:2222 root@12.0.0.10

So when on my local machine in a browser i specify SOCKS proxy 20.0.0.11:2222 (serverB:2222) as external IP while browsing i get 12.0.0.10 (serverA IP). That is ok.

As well if i go onto http://10.0.0.5 (serverA private IP) it is also reachable. That is what i need. I want to make servers A private IP to be available through servers B public IP on certain ports but without specifying SOCKS in my browser.

I could use ssh port forward but the problem is - i need to forward many ports and do not know which exactly - i know only the range.

So when i connect to 20.0.0.11 to any port , for example, from 3000:4000 range, i want that traffic to be redirected to 10.0.0.5 on the same port. That is why i`ve decided maybe SOCKS proxy via SSH and iptables REDIRECT could help me.

Client -> serverBPublicIP (any port from range 3000:4000) -> serverAPublicIP -> serverAPrivateIP (the port was requested on serverBPublicIP)

On serverB i do:

ssh -D20.0.0.11:2222 root@12.0.0.10
iptables -t nat -A PREROUTING -d 20.0.0.11 -p tcp --dport 3000:4000 -j REDIRECT --to-port 2222

But that does not work - when i telnet on 20.0.0.11:3001 for example i do not see any proxied traffic on the serverA. What should i do else? I have tried tcpsocks like this (in example i am telneting to 20.0.0.11:3001)

Client -> 20.0.0.11:3001 -> iptables REDIRECT from 3001 --to-port 1111 -> tcpsocks from 1111 to 2222 -> SOCKS proxy from serverB to serverA on port 2222 -> serverA

But i do not know what to do with the traffic on serverA. How to route it to its private IP. Help me please. I know, VPN removes all the hell i am trying to create, but i have no ability to use tun/tap device. It is disabled.

share|improve this question
    
If you want help with your solution using tcpsocks, you're going to have to tell us how you're invoking tcpsocks. The documentation for tcpsocks at github.com/vi/tcpsocks will probably be useful to you. –  Per von Zweigbergk Dec 3 '11 at 3:24
    
@Radium: You first try (iptables redirect to 2222) will not work, because it only redirects TCP traffic and the clients to "speak socks", which 2222 will require. To see why your second try did not work, we need to see what you tried exactly (how did you use tcpsocks?) –  Steffen Heil Apr 21 '13 at 11:32
    
Can you try with SSH and tun interfaces instead of socks? –  LatinSuD Sep 10 at 17:24

1 Answer 1

An alternative would be to do is to do something like:

ssh -L 3000:10.0.0.5:3000 -L 3001:10.0.0.5:3001 .... -L 4000:10.0.0.5:4000 12.0.0.10

This will set up a thousand and one seperate ssh tunnels for each port. I have never tried setting up over a thousand simultaneous ssh tunnels, so I have no idea what the performance is going to be like, or if it's even going to work at all, or if you're going to have to set up multiple parallell ssh processes.

It's going to be a pretty long command line, I would suggest writing some kind of script to actually invoke the command.

All in all I would not recommend this, if at all possible, set up a VPN.

Is there any reason your users can't just connect to 12.0.0.10 directly? Or are the ports not exposed through the firewall? If not, can't you just open up the ports in the firewall from selected IP addresses, or do you have security considerations that don't let you do this?

share|improve this answer
    
Yeap, i was doing that with autossh -M 0 -nfR ... using the script. But it allows to forward only 100 ports a time. So i need to lunch seperate process for each 100 ports. If the are many ports i would eat all the RAM i have. The reasons are the same when i use VPN. The difference is i can`t use it :) –  Radium Dec 3 '11 at 9:37

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.