2

I'm sure the answer to this would be available on Google but I don't really know what I'm Google-ing for.

Situation;

We have two networks; our own internal network (192.168.0.[0-255]) and our 'server' network (Internal addresses are 192.168.1.[0-255]). Our server network is located in a remote datacenter, and our servers are hired dedis (I.E. we have full control over the server software, a mix of RedHat 5/6 and FreeBSD, but no control over the network hardware or server hardware). Our server network sits behind a firewall limiting certain external ports which we also have full software control over, but it's features are limited to just that, a firewall/NAT (no fancy VPN stuff etc). Our internal network is reasonably basic, we have a 20Mb/s line from our ISP connected to a fairly typical Netgear home router. We also have a Mac OS/X server which runs our network services (DNS, DHCP etc.)

What we want;

What we'd like to be able to do is, from these completely separate networks, be able to access servers on the other network just using the IP address or internal hostname (same difference).

So I'm sitting at my workstation, 192.168.0.10, on our internal network. If I open up my terminal and ssh 192.168.1.20 it would connect to the server at 192.168.1.20 in our server network, as though it was sat in the room*. Similarly if I was SSH'd into a server and wanted to pull something down from our Mac server on our internal network, I should be able to just scp 192.168.0.100:file ./.

This extends to other things, like mounting an NFS drive on a server to our desktops*, connecting to our databases without having to open ports on the firewall (We lock them down to our static external IP address, but it's still annoying).

I kind of know what I want, but I'm not really sure where to start. I guess the easiest way would be some sort of VPN connection between the two sites, then we would route certain IPs through the VPN tunnel, I have no idea if that's even possible.

Is there something software only (We can get new hardware on our internal network, but like I say we have no physical access to our server infrastructure) that would achieve this?

This is probably a silly question with an obvious answer, but I'm still stumped.

*Performance might be terrible, but it would be no worse than connecting remotely.

3 Answers 3

2

EDIT: The bulk of this answer helps you ssh to a box on your internal network seamlessly. See below in the section labeled "Working with other network resources" to read more about that.

You can also do this pretty elegantly with SSH:

Step 1: Set up/pick a jump box

Many corporate networks have what's typically referred to as a "bastion host" or a jump box. This machine normally has many of its network services disabled, save ssh (and often on a non-standard port). If you don't have a machine like this on your 'server' network, find a box that's accessible via ssh from your internal network to test with.

Step 2: Edit your ssh config file

Find your ssh config file (often in ~/.ssh/config) and fire up your favorite text editor. Say your jump box is at jump.foo.com and one of the hosts you want to access is at server.foo.com. Include the following:

Host server.foo.com
  User <username>
  ProxyCommand /usr/bin/nc -x localhost:1080 %h %p

Host jump.foo.com
  User <username>
  DynamicForward localhost:1080

replacing <username> with your username. You may also need to edit the path to nc (netcat): note that this is the path to netcat on your localhost. In case the config doesn't make 100% sense, I'll break it down:

The jump.foo.com config includes a directive to start a SOCKS proxy listening on the specified port (in my example, port 1080). This means that when you ssh to jump.foo.com, you're also starting up a SOCKS proxy automatically... stay tuned.

The server.foo.com config says: when I ssh to server.foo.com, execute the specified ProxyCommand:

/usr/bin/nc -x localhost:1080 %h %p

where the -x option lets you specify the proxy address (in this case, the connection on localhost on port 1080 we just opened), %h = host and %p = port.

Step 3: ssh

ssh to jump.foo.com (I use tmux, a screen alternative, and always have one window open with a connection to my jump.foo.com). Now, in a separate window/terminal, try to simply ssh directly to server.foo.com. I should note that server.foo.com can be an internal hostname or and internal IP address (on your server network).

Assuming you got everything right, you should be passed on to server.foo.com without a problem.

There are a lot of ways to make this process more seamless, with more robust ssh configs and bash aliases. Here are some articles I used as a reference a while back when I first set this up, which should point you in the right direction:

http://blog.gidley.co.uk/2009/03/tunnelling-ssh-over-socks-proxy.html http://blog.electricjellyfish.net/2006/03/dynamicforward-where-have-you-been-all.html http://bent.latency.net/bent/git/goto-san-connect-1.85/src/connect.html

Working with other network resources

Say you need to remote desktop into a host windows.foo.com on your 'server' network. In one window,

ssh -L 3390:windows.foo.com:3389 jump.foo.com

This forwards all traffic on port 3390 on localhost to port 3389 (the standard remote desktop port) on windows.foo.com. To actually remote in to windows.foo.com, point your remote desktop application to localhost:3390 and you should be able to transparently connect to windows.foo.com.

man ssh or Google "ssh port forwarding" for more info.

Also remember that you can always

telnet <server> <port>

to make sure you can talk to <server> on port, a la

telnet localhost 3390

Adding new hosts on the foo.com network

You would not have to configure an entry for each server on your jump box. Just

ssh -o "ProxyCommand /usr/bin/nc -x localhost:1080 %h %p" new.server.foo.com

And yes, you should be able to hit hosts on your internal network by hostname or IP.

Just like we'd defined it in our ssh config file, you can pass the ProxyCommand arg to ssh with the -o option. Again, this should send your ssh traffic to new.server.foo.com through that same SOCKS proxy on port 1080.

For each foo.com domain, you can simply add a wildcard rule in your ssh config file:

Host *.foo.com
      User <username>
      ProxyCommand /usr/bin/nc -x localhost:1080 %h %p

If you want to ssh to a host that doesn't have an entry in your config file, you can also use a bash alias:

alias ssh-socks='ssh -o "ProxyCommand /usr/bin/nc -x localhost:1080 %h %p"'

ssh-socks newer.server.foo.com

I'm not sure if the DNS request is made by your localhost, or if it happens from the jump box. I tried a tcpdump on localhost when ssh'ing to a few hosts on my 'server' network

tcpdump port 53

and didn't actually see any traffic (no entires in /etc/hosts... I would have had to make a DNS request to hit the host). This might mean that DNS requests are made from the jump box, but I can't be 100% confident.

2
  • Interesting, I'll definitely play around with this, but I'm assuming we would need to configure each server on the 'jump box'? I.E. we couldn't just add another server to our server network and be able to go straight to it's IP
    – user80776
    Dec 22, 2011 at 12:49
  • Nope, you wouldn't have to configure anything on your jump box! I edited the question to address the questions in your comment: "Adding new hosts on the foo.com network", near the bottom
    – tcdyl
    Dec 23, 2011 at 2:39
1

VPN can solve your problem. I recommend OpenVPN.

But if you wan only SSH and SCP, it will be enough if you just configure NAT settings on your border routers.

For example: open the port (for example) 2200 throught 2210 on your border router on detached workplace

like this:

  • 2200 will translate to port 22 and address 192.168.1.20
  • 2201 will translate to port 22 and address 192.168.1.21
  • and so on..

after that, you can connect to detached workplace:

ssh <wan_ip_of_detached_workplace> -p 2200

this will connect to 192.168.1.20 on your detached workplace.

Hope this will help.

4
  • Testing with VPN, it needs to be set up on every client to function correctly, it also overwrites our local network settings. We want the two networks to appear to computers as a single physical network (on different sub-nets). At least that's my knowledge, please correct me if I'm wrong
    – user80776
    Dec 21, 2011 at 15:29
  • @sam: If you put it this way, then the answer is: not possible in TCP/IP protokol. If it will be somehow possible, then it will be pretty difficult to configure.
    – readyblue
    Dec 21, 2011 at 22:16
  • I've seen it (or at least something similar) done before at a company I worked at before, linking our 3 DC's. It was always referred to as 'The WAN' but I can't find any information on setting something like that up. It might be a hardware solution, which would rule it out for our usage, but would still be interesting to know. Thanks for the help anyway
    – user80776
    Dec 21, 2011 at 23:39
  • You can configure OpenVPN to perform "split tunnelling", which would allow you to route only (for example) 192.168.1.0/24 through the VPN. Dec 22, 2011 at 16:55
0

VPN tunnel is an answer, with small bad addition (part of details only below)

This tunnel must be (well, a lot better have to be, you can as last resort use p2p VPN-tunnel from host to host) established between borders, will appear as additional WAN-link, which route inside itself all traffic for "remote" network (and yes, remote network may be visible from local, it depends... but doable).

It can be hardware solution or pure software (OpenVPN will fir into SW-solution), but - too complex in order to write here all details in one attempt.

Try to start from OpenVPN on-site docs (if you can install it on both sides) and understand samples for different connection-types from it

You must log in to answer this question.