Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have to create an SSH tunnel to connect a deployment server to an VPN:

DeploymentServer --> Gateway --> PrivateServer

Each machine using a key, I tried the following command:

myMachine $ ssh -i GATEWAY_KEY.pem -N -L 1122:ubuntu@SERVER_PRIVATE_IP:22 ubuntu@GATEWAY_IP

And then this one in other terminal window:

myMachine $ ssh -i PRIVATE_SERVER_KEY.pem -p 1122 ubuntu@SERVER_PRIVATE_IP

But it doesn't work, I get a timeout error. My port 1122 is open and I can SSH it. I don't what I'm doing wrong, is my syntax correct?

It's my first tunnel so don't laugh at me!


EDIT 1

I added -v and fixed the second SSH call.


First call: myMachine $ ssh -i GATEWAY_KEY.pem -N -L 1122:ubuntu@SERVER_PRIVATE_IP:22 ubuntu@GATEWAY_IP -v Response: debug1: Authentication succeeded (publickey).

Second call: myMachine $ ssh -i PRIVATE_SERVER_KEY.pem -p 1122 ubuntu@localhost -v

debug1: Reading configuration data /etc/ssh_config
debug1: /etc/ssh_config line 20: Applying options for *
debug1: Connecting to localhost [::1] port 1122.
debug1: Connection established.
debug1: permanently_set_uid: 0/0
debug1: identity file .ssh/wamapi_staging.pem type -1
debug1: identity file .ssh/wamapi_staging.pem-cert type -1
ssh_exchange_identification: Connection closed by remote host

And in the first tab again:

debug1: Connection to port 1122 forwarding to ubuntu@10.0.5.128 port 22 requested.
debug1: channel 2: new [direct-tcpip]
channel 2: open failed: administratively prohibited: open failed
debug1: channel 2: free: direct-tcpip: listening port 1122 for ubuntu@10.0.5.128 port             22, connect from ::1 port 60341, nchannels 3
share|improve this question
    
What are you trying to do? ssh to "PrivateServer"? Or establish a VPN somewhere?! –  faker Jun 17 '13 at 19:17
add comment

2 Answers 2

I made it work using the .ssh/config file instead of trying to put all my parameters in my commands. Here is the results if someone needs it:

Host the-gateway
  Hostname GATEWAY_IP
  Port 22
  User ubuntu
  IdentityFile ~/.ssh/keys/GATEWAY_KEY.pem

Host the-tunnel
  Hostname localhost
  Port 1122
  User ubuntu
  IdentityFile ~/.ssh/keys/PRIVATE_SERVER_KEY.pem

And then the 2 commands:

ssh -N -L 1122:SERVER_PRIVATE_IP:22 the-gateway
ssh the-tunnel

Doing that way, SSH can use my pem keys.

share|improve this answer
add comment

If I understood your question correctly, and you want to ssh to "PrivateServer", then your second ssh call should be:

myMachine $ ssh -i PRIVATE_SERVER_KEY.pem -p 1122 ubuntu@localhost

If not, please clarify in a comment on your question.

share|improve this answer
    
Thanks, I can wait until tomorrow to see if ubuntu@localhost works for me. –  Guilhem Soulas Jun 17 '13 at 19:50
    
Hi @faker, I tried with ubuntu@localhost and localhost but I have these error messages: ssh_exchange_identification: Connection closed by remote host (second ssh call) and channel 2: open failed: administratively prohibited: open failed (first ssh call). –  Guilhem Soulas Jun 18 '13 at 9:23
    
Are you able to ssh from the gateway to the private server? In any case, try adding -v to both ssh calls and edit the output into your question. –  faker Jun 18 '13 at 9:41
    
I edited my initial question. I can SSH the private server from the gateway on port 22 without any problem. Maybe should I use another port here also? –  Guilhem Soulas Jun 18 '13 at 11:41
    
On the gateway, is AllowTcpForwarding set to no in sshd_config? I'm running out of ideas, it should work like you posted. –  faker Jun 18 '13 at 11:54
show 3 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.