41

My situation :

Me(localhost) -> Server A(ip:100.100.100.100) =>(server B(ip:192.168.25.100),server....)

i'm able to SSH into server since it has a true ip if i then want to connect to server b, i would ssh server b with it's ip(192.168.25.100)

example:

from my pc: 

ssh [email protected]

then in 100.100.100.100, 

ssh [email protected]

this would get me to server B with ssh

what if i want to connect to server b directly? how can i do that?

example:

from my oc:

[email protected]

i have tried the following:

ssh -L 22:localhost:22 [email protected]

without success

Improve this question

6 Answers 6

Reset to default
36

Your problem is in binding a listener to localhost:22; there's already an sshd listening on that. Tunnelling an ssh connection through an ssh connection is completely lawful, and I do it all the time, but you need to pick unused ports for your forwarding listeners.

Try

me% ssh [email protected] -L 2201:192.168.25.100:22

then

me% ssh localhost -p 2201

You should end up on server B (unless something's already bound to me:2201, in which case, pick another port).

Improve this answer
7
  • thanks for the quick reply! it does work, however, how i can forward all connections instead of only ssh(22)?
    – tom91136
    Dec 15, 2011 at 12:00
  • 1
    That's a full-blown VPN you're looking for, not just port-forwarding. There's a writeup on how to do vpn-over-ssh at bodhizazen.net/Tutorials/VPN-Over-SSH , but it requires remote root access via ssh on A. Or you could look into OpenVPN or other VPN solutions, but again, you'll need privilege on A to make these work.
    – MadHatter
    Dec 15, 2011 at 12:06
  • thanks a lot, one last thing, what if i only want to connect to A?
    – tom91136
    Dec 15, 2011 at 12:12
  • me% ssh [email protected] ; didn't we already cover that? or do you mean "what if I want a full-blown VPN to A?", in which case my answer stands.
    – MadHatter
    Dec 15, 2011 at 12:19
  • 1
    For people who want VPN over SSH, don't have root access on the server but it does have Python, try sshuttle.
    – André Paramés
    Dec 15, 2011 at 15:50
33

You don't have to use ssh port forwarding to ssh into an internal computer through a proxy. You can use the ssh feature of executing a command on the first server you connect to in order to ssh into a 3rd computer.

ssh -t [email protected] ssh [email protected]

The -t option forces ssh to allocate a pseudo-tty so you can run an interactive command.

This can work with ssh keys as well. If you have your private and public key on machine A and your public key in the authorized keys files on machines B and C, then you can use the -A option to forward the authentication agent connection.

Improve this answer
1
  • 3
    Use -A with caution and only if the jump host is fully trusted. A safer and simpler alternative is to use ssh -J jumphost destination if the -J option is available.
    – coldfix
    Aug 10, 2020 at 16:01
17

As of OpenSSH 7.3 (late 2016) the easiest way is the ProxyJump setting. In your ~/.ssh/config:

Host B
  ProxyJump A

Or on the command line, -J B.

Improve this answer
11

I used a different solution. I used a ProxyCommand option (here in ~/.ssh/config):

Host myinsidehost1 myinsidehost2 myinsidehost3
ProxyCommand ssh externalhost ssh %h sshd -i

This doesn't set up any port-to-port tunnel, instead tunnels ssh by using standard stdin/out. This method has a drawback that there are actually three ssh connections to authenticate. But to connect to the internal host you just type:

ssh myinsidehost2

...so you do not need to care about choosing any IP for that tunnel.

Improve this answer
1
  • 1
    This is the only kind of SSH stacking that I find working. I've been tried corkscrew or nc (netcat) but none work as seamlessly as this.
    – Phuong Nguyen
    Sep 16, 2014 at 16:38
8

according to the ssh man page, ProxyCommand is the correct method

the syntax being:

ProxyCommand ssh -W %h:%p user@jumphost 2> /dev/null
Improve this answer
3
  • I am not sure the -W option existed when this question was answered. But with newer versions of the ssh client, I agree that the combination of ProxyCommand and -W is the preferred method. Maybe add some context showing both how it can be used on the command line as well as an example of a section for .ssh/config.
    – kasperd
    Jul 21, 2015 at 8:18
  • Any idea where to find the changelogs/version info that tells us which versions of SSH have the -W command and which don't? A bit of googling did not yield answers quickly for me...
    – dmh
    Aug 1, 2017 at 13:01
  • -W got introduced with OpenSSH 5.4, released in 2010. So the answer is yes @kasperd
    – 0xC0000022L
    Mar 27, 2018 at 19:59
5

While ProxyJump has already been mentioned, it's most useful for static hosts you keep connecting to. If the machines keep changing, it's much easier to use -J (jump host) command line argument:

Once you know what it's doing, the syntax is pretty straightforward:

ssh -J [email protected] [email protected]

The above command establishes a connection to 100.100.100.100 as user1, then from there "jumps" to 192.168.25.100 as user2

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .