Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have the following setup:

  • A machine on the local network that is connected to a VPN on another network, lets call it machine A
  • A machine on the local network that has access to machine A, but with no access to the VPN. Lets call it machine B.

Now if I want to access hosts inside the VPN from machine B, I could certainly do ssh forwarding or chained ssh calls (e.g. ssh machine-a ssh machine-vpn) but that gives me only limited access (i.e. as many ports as I specify in SSH tunnel using the -L option). Is there a way to create some sort of "Virtual Host" using SSH such that any connection to that Virtual Host in SSH will be forwarded to the target host inside the VPN, regardless of the port? To put the question in another way:

From machine A:

ssh -L 16000:machine-vpn:22 machine-a #creating the initial tunnel to the SSH port on machine-vpn
#now ssh -p 16000 localhost does an SSH to the machine behind the vpn
#create the Virtual Host somehow using SSH, call the virtual host vhost
ssh vhost #this will ssh to the machine behind the vpn, using ssh tunnel
ftp vhost #this will ftp to the machine behind the vpn, using ssh tunnel

Is there anyway to do that kind of thing?

share|improve this question

SSH also supports dynamic forwarding. By specifying a dynamic port, the ssh client will create a SOCKS5 proxy which you can then use to forward all traffic and have it leave from the remote host.

ssh -D2000 machine-a

You can configure most programs (browsers and ftp, etc) to use a socks proxy. All you would need to do in this example is point to localhost:2000 as a SOCKS proxy.

share|improve this answer

Look at the Tunnel and TunnelDevice options in recent versions of OpenSSH.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.