2

I have googled and haven`t found the answer on my question. Help me please. There are two servers:

serverA with public IP 12.0.0.10 and an private IP 10.0.0.5
serverB with public IP 20.0.0.11

I have setup SOCKS proxy on serverB to serverA:

ssh -D20.0.0.11:2222 [email protected]

So when on my local machine in a browser i specify SOCKS proxy 20.0.0.11:2222 (serverB:2222) as external IP while browsing i get 12.0.0.10 (serverA IP). That is ok.

As well if i go onto http://10.0.0.5 (serverA private IP) it is also reachable. That is what i need. I want to make servers A private IP to be available through servers B public IP on certain ports but without specifying SOCKS in my browser.

I could use ssh port forward but the problem is - i need to forward many ports and do not know which exactly - i know only the range.

So when i connect to 20.0.0.11 to any port , for example, from 3000:4000 range, i want that traffic to be redirected to 10.0.0.5 on the same port. That is why i`ve decided maybe SOCKS proxy via SSH and iptables REDIRECT could help me.

Client -> serverBPublicIP (any port from range 3000:4000) -> serverAPublicIP -> serverAPrivateIP (the port was requested on serverBPublicIP)

On serverB i do:

ssh -D20.0.0.11:2222 [email protected]
iptables -t nat -A PREROUTING -d 20.0.0.11 -p tcp --dport 3000:4000 -j REDIRECT --to-port 2222

But that does not work - when i telnet on 20.0.0.11:3001 for example i do not see any proxied traffic on the serverA. What should i do else? I have tried tcpsocks like this (in example i am telneting to 20.0.0.11:3001)

Client -> 20.0.0.11:3001 -> iptables REDIRECT from 3001 --to-port 1111 -> tcpsocks from 1111 to 2222 -> SOCKS proxy from serverB to serverA on port 2222 -> serverA

But i do not know what to do with the traffic on serverA. How to route it to its private IP. Help me please. I know, VPN removes all the hell i am trying to create, but i have no ability to use tun/tap device. It is disabled.

3
  • If you want help with your solution using tcpsocks, you're going to have to tell us how you're invoking tcpsocks. The documentation for tcpsocks at github.com/vi/tcpsocks will probably be useful to you. Dec 3, 2011 at 3:24
  • @Radium: You first try (iptables redirect to 2222) will not work, because it only redirects TCP traffic and the clients to "speak socks", which 2222 will require. To see why your second try did not work, we need to see what you tried exactly (how did you use tcpsocks?) Apr 21, 2013 at 11:32
  • Can you try with SSH and tun interfaces instead of socks?
    – LatinSuD
    Sep 10, 2014 at 17:24

2 Answers 2

0

An alternative would be to do is to do something like:

ssh -L 3000:10.0.0.5:3000 -L 3001:10.0.0.5:3001 .... -L 4000:10.0.0.5:4000 12.0.0.10

This will set up a thousand and one seperate ssh tunnels for each port. I have never tried setting up over a thousand simultaneous ssh tunnels, so I have no idea what the performance is going to be like, or if it's even going to work at all, or if you're going to have to set up multiple parallell ssh processes.

It's going to be a pretty long command line, I would suggest writing some kind of script to actually invoke the command.

All in all I would not recommend this, if at all possible, set up a VPN.

Is there any reason your users can't just connect to 12.0.0.10 directly? Or are the ports not exposed through the firewall? If not, can't you just open up the ports in the firewall from selected IP addresses, or do you have security considerations that don't let you do this?

1
  • Yeap, i was doing that with autossh -M 0 -nfR ... using the script. But it allows to forward only 100 ports a time. So i need to lunch seperate process for each 100 ports. If the are many ports i would eat all the RAM i have. The reasons are the same when i use VPN. The difference is i can`t use it :)
    – Radium
    Dec 3, 2011 at 9:37
0

I know, VPN removes all the hell i am trying to create, but i have no ability to use tun/tap device. It is disabled.

That sounds a little strange, but tun/tap would (AFAIK) only be used for an SSL VPN (e.g. openVPN).

Which means you might have better luck with an IPSEC VPN like strongswan (https://strongswan.org/), which doesn't use tun/tap devices.

As you say, running 10s or 100s of SSH tunnels side by side is a little taxing, and brittle.

If an IPSEC VPN isn't going to work either, then you might want to try putting haproxy on server A, and creating a single SSH forward (-L) instead of a SOCKS (-D) tunnel. This way, you can configure a (web)server on B to use that forwarder as an upstream, and use haproxy on A to deal with the multiple services, etc.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .