Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top


^        ^-         |
        v-         |

Ports AC,BC has valid internet addresses. All systems run linux and have root acces to all.

Need securely rsync internal_server_1:/some/path into internal_server_2:/another/path

My idea is make ssh secure tunnel between two firewalls, e.g. from firewall_1

firewall1# ssh -N -p 22 -c 3des -L xxx/

and after will run rsync from internal_server_1 somewhat like:

intenal1# rsync -az /some/path

I don't know

  • how to make a correct ssh tunnel for rsync (what ports need tunnel)
  • and to where i will make the rsync? (remote comp address in case of ssh tunnel)

Any idea or pointer to helpfull internet resource for this case?


share|improve this question
Can you directrly connect from internal_server_1 to firewall_2? That would make things much more easy. – Julian Apr 14 '12 at 16:22
up vote 1 down vote accepted

I'm assuming the SSH port on firewall_2 ("BC" in your diagram) is accessible from the outside. Can computers on network 1 (10.2.0.*) reach the internet directly (i.e. via NAT), or only by proxying via firewall_1? Since you don't specify, I'll assume not.

Probably the simplest thing to do is to tunnel rsync over SSH tunneled over SSH (clearly, "simplest" is relative). First, build the outer tunnel by running this on firewall_1:

firewall_1# ssh -N -p 22 -c 3des -L

Note that this runs the local (firewall_1) end of the tunnel on bound to its internal IP (, on an arbitrary port (I used 5432).

Then, from server_1, run rsync and use its -e option to run it over SSH:

server_1# rsync -e "ssh -N -p5432 -c 3des" -a /local/path server2user@

This SSHes into port 5432 on the IP address, which the outer tunnel forwards to (server_2) port 22 (standard SSH).

BTW, if coordinating the setup on multiple computers (i.e. creating a tunnel from firewall_1 and then using it from server_1) is difficult, let me know; with a bit more complexity, it's possible to fire it all off from server_1 with a single command. Although you should be able to set up the outer tunnel once, and then just leave it up...

share|improve this answer

SSH has an option called ProxyCommand which allows you to pass all SSH traffic to a command which can be run on a different host. Probably you can chain multiple of these together to achieve what you want to do.

If you can directly connect from internal_server_1 to firewall_2, you can use something like this (for example as value for -e if you're using rsync):

ssh -o ProxyCommand="ssh -W %h:%p firewall_2" internal_server_2
share|improve this answer
+1 Cannot thank you enough for pointing this out. A quick google on ProxyCommand gave me this page, which did exactly what I need to do. Doing it manually with LocalForward, etc., was a painful mess. This is a breeze, once I put things in .ssh/config, and made a few aliases. – Mike Mar 21 '13 at 15:55

rsync uses SSH (port 22) by default. So, you need to do port-forwarding on your firewalls to be able to rsync from internal server 1 to internal server 2.

This can be done using iptables on firewall1 and firewall2 as follows:

On firewall1

iptables -A POSTROUTING -s -p tcp --dport 5022 -j SNAT --to-source AC.IP.addr.ess

On firewall2

iptables -A PREROUTING -s AC.IP.addr.ess -p tcp --dport 5022 -j DNAT --to-destination

Using such rules, you can access internal server2 from internal server1 using port 5022 like:

internal_server1$ ssh -p 5022 user@BC.public.ip.addr
share|improve this answer
This is just an example. You can choose another port/IP if you want. – Khaled Apr 14 '12 at 8:59

a tested complete command is like this:

rsync -av --delete -e "ssh -o ProxyCommand='ssh -l username -W %h:%p jumphost-ip'" ./source_path/ username@internal-ip:/dest_path/
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.