Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to establish a SSH tunnel to allow VNC/ARD connections (ports 5900 and 3389). However I'm uncertain about a certain thing:

Let's say machine A has IP 192.168.103.1 and has services running on ports 5900 and 3389.

I want to SSH to the server that has IP 192.168.103.254.

Machine B 192.168.103.2 wants to connect to machine A by using an tunnel on the server 192.168.103.254 and different ports (let's say 6001 and 4001)

So, the setup will look like this:

Machine B 192.168.103.2 --> VNC to Server 192.168.103.254:6001 (Server redirect --> 192.168.103.1:5900)

I know a little bit about SSH tunnel and reverse SSH tunneling but I'm unsure which command I need.

Please note:

  • The Client PC has to connect to the server (the other way around is not possible since the clients have different IP addresses everytime)

Things I tried:

ssh -f user@server.hostname.net -L 6001:localhost:5900 -N

This command succeeds but when I try to connect to it I get a connection refused error:

Tims-Macbook-Pro:~ Tim$ telnet server.hostname.net 6001
Trying 192.168.103.254...
telnet: connect to address 192.168.103.254: Connection refused
telnet: Unable to connect to remote host

I also tried this

sudo ssh -NT -R 6001:localhost:5900 user@server.hostname.net

The command also gives a connection refused error when I'm trying to access it.

Tims-Macbook-Pro:~ Tim$ telnet server.hostname.net 6001
Trying 192.168.103.254...
telnet: connect to address 192.168.103.254: Connection refused
telnet: Unable to connect to remote host
share|improve this question
    
What have you tried? Anything? Give us the commands you tried, what you expected to happen, and what actually happened. As it is, you're asking for us to spoon-feed you a solution, which would be very un-professional of us to do. –  EEAA Feb 12 at 14:26
    
@EEAA Sorry, Added the things I tried. Thank you. –  Timothy Feb 12 at 14:30

2 Answers 2

You should reach Machine A's port 5900 when connecting to the server's localhost port 6001 with this command:

ssh -L 6001:192.168.103.1:5900 root@192.168.103.254

Check this resource for a deeper understanding of SSH tunneling: http://www.linuxhorizon.ro/ssh-tunnel.html

UPDATE:

If you need multiple clients accessing Machine A's port 5900 via the server like this:

Client1
Client2 ---> port 6001 ---> 192.168.103.254 ---> port 5900 --> 192.168.103.1
Client3

You need to run this command (In the client):

ssh -L 0.0.0.0:6001:192.168.103.1:5900 root@192.168.103.254

All clients connecting to the server port 6001 will reach Machine A's port 5900 with that command.

share|improve this answer
    
This works for the server itself but other clients can't use telnet 192.168.103.254 6001 because the connection gets refused: telnet: connect to address 192.168.1.254 Connection refused –  Timothy Feb 12 at 17:21
    
At first I thought this worked but I had to enter the commands on the server, which I can't like I said in my first post The Client PC has to connect to the server (the other way around is not possible since the clients have different IP addresses everytime) –  Timothy Feb 12 at 18:13
    
You mean, you need to be able to open the ssh tunnel from the client? –  Gabriel Talavera Feb 12 at 18:15
    
Yes, that's what I'm trying to do. Of course I could write a script that executes the above SSH command on the server but isn't there a better way to do this? –  Timothy Feb 12 at 19:10
    
Hmm.. I've never tried this, buy it may work, from the client, run: ssh user@server 'ssh -L 0.0.0.0:6001:192.168.103.1:5900 root@192.168.103.254'. That is going to run an ssh command via ssh. Replace user@server according to your needs. –  Gabriel Talavera Feb 12 at 19:13

You try to connect to your "gateway" server but we don't know if that kind of traffic is allowed. Your best bet is to try mapping the remote port to a local port, as you did in the first example, but you need to actually point to the server you want to connect to, like this:

ssh -f user@server.hostname.net -L 6001:192.168.103.1:5900 -N

If not, how would ssh know which IP needs to forward the connection to? By doing this you are mapping port 5900 of the remote server 192.168.103.1 to a LOCAL (your machine) port (6001 in this case) through a SSH tunnel via server.hostname.net.

Now, to connect you just access a local port:

telnet localhost 6001
share|improve this answer
    
I executed ssh -f osxserver@192.168.103.254 -L 6001:192.168.103.1:5900 -N on my client (machine A) and then tried the following command on machine B telnet 192.168.103.254 6001 however I'm still getting telnet: connect to address 192.168.103.254: Connection refused –  Timothy Feb 12 at 17:09
    
You are mapping a port from a remote machine to a local port in your own machine. That's why you should do the telnet to localhost: telnet localhost 6001. –  Migtor Feb 25 at 19:35

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.