I've been accessing a server's files via Sublime SFTP.

The issue is that I need to tunnel into my destination server via a middle-man server (that I have root access to).

ClientServer A (middle-man node) → Server B (destination node)

Normally I'd use a tunneling option in the client software, but in this case Sublime doesn't seem to have that feature.

What's the best way for me to configure the middle-man server (apache) to accomplish this? (or something like it)

For example, maybe there's a way to automatically have Server A connect to Server B when the client successfully connects to a particular port?

  • Is Apache the only service at your disposal on the middle server? If so, you're out of luck. – EEAA Apr 24 '17 at 23:13
  • No I can use other services typically found on linux machines or even configure a new one. – Orun Apr 24 '17 at 23:36
  • Yes you can forward sftp connections with any TCP transparent solution (including Kernel DNAT rules). A generic TCP proxy, HAProxy or even ssh server side forwards. For ftp/s it could be a bit more tricky because of the data connection. – eckes Apr 25 '17 at 11:19

With HAProxy you can create a TCP proxy to proxy the connection back to the backend server. I do this frequently.

  • Not sure why you were downvoted. I do this as well for ssh/sftp all the time and it's perfect. No extra buffer limits from yet another ssh session. It damonizes perfectly in user space, takes trivial amounts of memory and is rock solid. This wont work for standard ftp however. haproxy can also use acl's for access control. – Aaron Apr 25 '17 at 1:36
  • Thanks, I configured HAProxy just now. Is the solution you're describing a transparent proxy? As described here or something else? – Orun Apr 26 '17 at 16:08
  • 1
    No, you would configure HAProxy as if you were going to do TCP load balancing, although you would specify only one server as the backend. coolaj86.com/articles/… (not my blog) you can bind the frontend to port 2222, then have it redirect to server B on port 22. When you hit server A on port 2222, it should connect you through. – Linuxx Apr 26 '17 at 23:35

I would recommend that you use SSH Tunneling.

ssh -L 9999:server_b:22 username@server_a

You'll of course also need to confirm that Server A's firewall accepts inbound TCP connections on your port of choice.

  • Can't use ssh -L unfortunately as my client (Sublime Text) doesn't allow ssh with flags – Orun Apr 27 '17 at 20:44
  • You don't necessarily need to initiate the tunnel from Sublime, you just need the port available to it. I would recommend that you create the tunnel with a standalone ssh client of your choice, and then utilize the port that it has opened for you. – billkw May 1 '17 at 3:26

You could use rinetd to acomplish what you want:

apt install rinetd

Then you edit /etc/rinetd.conf, and add your configuration at the end:



# Server A IP:
# Server B IP:
# Listen on port 8080 on local server and redirect to 22 on remote server
# Configuration 8080 22

Finally you restart the service:

systemctl restart rinetd

And connect through SERVER A:

sftp -P 8080  user@SERVER_A_IP

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.