1

I often temporarily and quickly (ad-hoc) want to tunnel http traffic (and other protocols also) from one server to another using an ssh tunnel. I use for this (at source server):

ssh -f -n -L *:80:target-server.com:80 target-server.com sleep 11555200

Problem is that after a while there is hundreds of connections that I'll see by

lsof -n -i:80

ssh     17076 root    5u  IPv6 425353159       TCP <source-serverIP>:http->173.245.48.218:52116 (ESTABLISHED)
ssh     17076 root    8u  IPv6 425352908       TCP <source-serverIP>:http->82.177.80.10:49936 (FIN_WAIT2)
ssh     17076 root    9u  IPv6 425353148       TCP <source-serverIP>:http->173.245.48.218:31791 (ESTABLISHED)
ssh     17076 root   10u  IPv6 425353029       TCP <source-serverIP>:http->80.125.175.214:49837 (FIN_WAIT2)
ssh     17076 root   11u  IPv6 425353100       TCP <source-serverIP>:http->90.10.149.220:47749 (FIN_WAIT2)
ssh     17076 root   12u  IPv6 425353160       TCP <source-serverIP>:http->79.22.138.109:60744 (ESTABLISHED)
ssh     17076 root   13u  IPv6 425353105       TCP <source-serverIP>:http->90.10.149.220:53312 (FIN_WAIT2)

Those connections never seem to timeout. And when number of those reaches ~1024 tunnel does not accept new connections at all. What should I do for these connections timeout like it would without tunnel?

# lsof -n -i:80|grep 'FIN_WAIT2'|wc -l
1016

changing /proc/sys/net/ipv4/tcp_fin_timeout to a small value does not fix anything.

Also this issue seems to happen only with tunneled http traffic (maybe https too). With tunneling pop3/imap I saw no such issues.

Also I wonder how to change max limit of open tunnel connection to > 1024. I tied

ulimit -n 99999 ssh -f -n -L *:80:target-server.com:80 target-server.com 'ulimit -n 99999 && sleep 11555200'

but it does not fix it. Also setting tcp_max_orphans to a high value does not affect this.

  • You need a proper VPN. – Michael Hampton Sep 24 '13 at 12:43
  • Not really. It is very difficult to tunel only selected tcp port traffic via vpn if not almost impossible, not to mention is requires configuration changes on both sites and that is hardly ad-hoc material. – user191219 Sep 24 '13 at 19:32
  • Look into policy routing. – Michael Hampton Sep 24 '13 at 19:37
1

There are three sets of commands that enable connection keepalives.

TCPKeepAlive
ServerAliveInterval combined with ServerAliveCountMax
ClientAliveInterval combined with ClientAliveCountMax

TCPKeepAlive keeps a connection alive by sending a keepalive OUTSIDE of the standard ssh encryption, meaning any networking equipment can see that it's just a keepalive. This is spoofable. This method is not recommended.

ServerAliveInterval is initiated by the CLIENT. ServerAliveCountMax will set a maximum number of keepalives to send, after which a disconnect occurs.

ClientAliveInterval is the same as ServerAliveInterval except it is initiated by the Server.

Ensure that all three options are not being invoked. Check $HOME/.ssh/config and /etc/ssh/ssh_config.

  • As far as I gathered these options does not affect connection open via ssh tunelling but original ssh connection only - which should not and does not timeout. I use default ssh and sshd values on both sides and that means TCPKeepAlive is on so dead connections ssh are detected, however apparently not tunneled connections. – user191219 Sep 24 '13 at 20:20
  • The only keepalive that matters is the SSH connection. All machines between Host A and Host B only see an SSH connection. It does not see tunnels. It does not see that you're using vi on a file. It does not see that your tunnel is streaming the latest episode of Breaking Bad. It sees SSH. The SSH connection is the only thing that needs the keepalive. The SSH connection cannot and will not time out one of the tunnels. If the tunnel has timed out, so has the SSH connection itself. – UtahJarhead Sep 25 '13 at 11:58
1

You had it right the first time, except for the sleep delay.. which is in seconds! try a smaller value, for me this works (will close in 5 minutes):

ssh -f -n -L *:80:target-server.com:80 target-server.com sleep 300

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.