0

I have three machines

Source Machine
Destination Machine - IP 10.20.30.40
Intermediate Machine - Host server1.test.com

Source machine has SSH access to Intermediate machine and Intermediate machine has SSH access to Destination Machine but no direct access from source to destination

There is a script running on source which needs to SSH to destination. Script has IP address of destination configured and I cannot change it to a host name or localhost (then I could've used SSH port forward using intermediate server)

I checked some articles and everywhere its suggested to use iptables to forward IP to different destination

So I've decided to use iptables on source to forward destination IP to localhost on port 1234 using this:

iptables -t nat -A PREROUTING -p tcp -d 10.20.30.40 --dport 22 -j DNAT --to 127.0.0.1:1234

and then forward local port 1234 via intermediate machine to destination like this:

ssh server1.test.com -L 1234:10.20.30.40:22

Is this a good way to do this or is there any simple solution available?

3 Answers 3

0

iptables-DNAT rules will be replaced with the following settings.

(Script execution user's .ssh/config)
Host 10.20.30.40
    Hostname 127.0.0.1
    Port 1234

If ssh-portforward is running with the same user, I think it good to use the ProxyCommand.

Host 10.20.30.40
    ProxyCommand ssh server1.test.com nc %h %p
2
  • If your ssh client is up to date, you don't need nc. You could simply use ProxyCommand ssh -W %h:%p server1.test.com
    – kasperd
    May 5, 2016 at 9:02
  • @kasperd: Great !! I did not know. Thank you. May 5, 2016 at 16:08
0

Either use VPN connections for this (all machines connected via private network) which is safer or port forwarding (which is not a bad idea), just remember to limit connection IP pool on machine in private network.

0

Beware: read this only if you have root access to both source and intermediate machines.

Since you say source machine (let's call it A ) has no way to contact the destination one (called C ), I assume that there are routing or permission restrictions that prevent this. Restrictions that the intermediate (machine B) can avoid. You can make the source machine use this last one as gateway to reach your destination. Since I believe A and B are not on the same network, you can create an ssh vpn between A and B (A tun0's ip: 10.0.0.1, B tun0's ip: 10.0.0.2 both masked 255.255.255.252 in a p2p fashion) and issue the

# ip route add 10.20.30.40/32 via 10.0.0.2 dev tun0

on A. On the other hand, on B:

# echo 1 > /proc/sys/net/ipv4/ip_forward
# iptables -t nat -A POSTROUTING -s 10.0.0.1 -d 10.20.30.40/32 -j MASQUERADE

I won't go further on how to bring up an ssh vpn, since this is beyond your question. Check https://help.ubuntu.com/community/SSH_VPN if you think this can help you.

1
  • I don't have root access to intermediate server. Only on source machine :(
    – dusk7
    May 3, 2016 at 14:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .