Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've been trying this for a long time and I have not yet found a good solution. I have several servers behind a NAT that all run an SSH daemon. One of the machines is my main server which gets the SSH port forwarded to it. What I want is basically open a connection to other NATed servers by going through the main server similar to what I can achieve by opening a connection to the main server and then SSHing in to the destination. Since there are some applications that run on top of SSH I'd like to make automate this in order to run rsync or git on top of the connection itself.

Is there a reverse proxy for SSH?

share|improve this question
add comment

2 Answers 2

up vote 5 down vote accepted

You can do this using ProxyCommand and netcat in .ssh/config:

# Your 'gateway' server.
Host gateway

# Any other server.
Host server1
  ProxyCommand ssh gateway /bin/netcat %h %p

If you do ssh server1, you will open an SSH connection from your current location to your 'gateway' server, which will open a TCP connection to server1. This TCP connection will serve as the connection for SSH between your current location and server1.

Edit: This technique is commonly called 'ssh jumphost'.

share|improve this answer
2  
Related documentation with helpful diagrams: sshmenu.sourceforge.net/articles/transparent-mulithop.html –  Jodie C May 29 '12 at 14:37
    
Works like a charm. I'm wondering however which private key is used to log into the last machine, any idea? –  cdecker May 29 '12 at 15:47
    
The default private key, unless you specify anything else in your .ssh/config. You will create two SSH tunnels on top of each other, and you can use two different private keys for that. –  Oliver May 29 '12 at 15:54
add comment

While this isn't the same as bouncing connections around, to reduce complexity and dependency in similar situations I have had SSHD listen to dual ports, then forward from the router to individual servers the secondary port so that 22 works internally and server A may have port 2222 forwarded from the router, server B might have 2223, server C 2224, etc.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.