39

My situation :

Me(localhost) -> Server A(ip:100.100.100.100) =>(server B(ip:192.168.25.100),server....)

i'm able to SSH into server since it has a true ip if i then want to connect to server b, i would ssh server b with it's ip(192.168.25.100)

example:

from my pc:

ssh user@100.100.100.100

then in 100.100.100.100,

ssh user@192.168.25.100

this would get me to server B with ssh

what if i want to connect to server b directly? how can i do that?

example:

from my oc:

ssh@192.168.25.100

i have tried the following:

ssh -L 22:localhost:22 user@100.100.100.100

without success

6 Answers 6

35

Your problem is in binding a listener to localhost:22; there's already an sshd listening on that. Tunnelling an ssh connection through an ssh connection is completely lawful, and I do it all the time, but you need to pick unused ports for your forwarding listeners.

Try

me% ssh user@100.100.100.100 -L 2201:192.168.25.100:22

then

me% ssh localhost -p 2201

You should end up on server B (unless something's already bound to me:2201, in which case, pick another port).

7
  • thanks for the quick reply! it does work, however, how i can forward all connections instead of only ssh(22)?
    – tom91136
    Dec 15, 2011 at 12:00
  • 1
    That's a full-blown VPN you're looking for, not just port-forwarding. There's a writeup on how to do vpn-over-ssh at bodhizazen.net/Tutorials/VPN-Over-SSH , but it requires remote root access via ssh on A. Or you could look into OpenVPN or other VPN solutions, but again, you'll need privilege on A to make these work.
    – MadHatter
    Dec 15, 2011 at 12:06
  • thanks a lot, one last thing, what if i only want to connect to A?
    – tom91136
    Dec 15, 2011 at 12:12
  • me% ssh user@100.100.100.100 ; didn't we already cover that? or do you mean "what if I want a full-blown VPN to A?", in which case my answer stands.
    – MadHatter
    Dec 15, 2011 at 12:19
  • 1
    For people who want VPN over SSH, don't have root access on the server but it does have Python, try sshuttle. Dec 15, 2011 at 15:50
32

You don't have to use ssh port forwarding to ssh into an internal computer through a proxy. You can use the ssh feature of executing a command on the first server you connect to in order to ssh into a 3rd computer.

ssh -t user@100.100.100.100 ssh user@192.168.25.100

The -t option forces ssh to allocate a pseudo-tty so you can run an interactive command.

This can work with ssh keys as well. If you have your private and public key on machine A and your public key in the authorized keys files on machines B and C, then you can use the -A option to forward the authentication agent connection.

1
  • 3
    Use -A with caution and only if the jump host is fully trusted. A safer and simpler alternative is to use ssh -J jumphost destination if the -J option is available.
    – coldfix
    Aug 10, 2020 at 16:01
16

As of OpenSSH 7.3 (late 2016) the easiest way is the ProxyJump setting. In your ~/.ssh/config:

Host B
  ProxyJump A

Or on the command line, -J B.

11

I used a different solution. I used a ProxyCommand option (here in ~/.ssh/config):

Host myinsidehost1 myinsidehost2 myinsidehost3
ProxyCommand ssh externalhost ssh %h sshd -i

This doesn't set up any port-to-port tunnel, instead tunnels ssh by using standard stdin/out. This method has a drawback that there are actually three ssh connections to authenticate. But to connect to the internal host you just type:

ssh myinsidehost2

...so you do not need to care about choosing any IP for that tunnel.

1
  • 1
    This is the only kind of SSH stacking that I find working. I've been tried corkscrew or nc (netcat) but none work as seamlessly as this. Sep 16, 2014 at 16:38
8

according to the ssh man page, ProxyCommand is the correct method

the syntax being:

ProxyCommand ssh -W %h:%p user@jumphost 2> /dev/null
3
  • I am not sure the -W option existed when this question was answered. But with newer versions of the ssh client, I agree that the combination of ProxyCommand and -W is the preferred method. Maybe add some context showing both how it can be used on the command line as well as an example of a section for .ssh/config.
    – kasperd
    Jul 21, 2015 at 8:18
  • Any idea where to find the changelogs/version info that tells us which versions of SSH have the -W command and which don't? A bit of googling did not yield answers quickly for me...
    – dmh
    Aug 1, 2017 at 13:01
  • -W got introduced with OpenSSH 5.4, released in 2010. So the answer is yes @kasperd Mar 27, 2018 at 19:59
3

While ProxyJump has already been mentioned, it's most useful for static hosts you keep connecting to. If the machines keep changing, it's much easier to use -J (jump host) command line argument:

Once you know what it's doing, the syntax is pretty straightforward:

ssh -J user1@100.100.100.100 user2@192.168.25.100

The above command establishes a connection to 100.100.100.100 as user1, then from there "jumps" to 192.168.25.100 as user2

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.