39

My situation :

Me(localhost) -> Server A(ip:100.100.100.100) =>(server B(ip:192.168.25.100),server....)

i'm able to SSH into server since it has a true ip if i then want to connect to server b, i would ssh server b with it's ip(192.168.25.100)

example:

from my pc: 

ssh user@100.100.100.100

then in 100.100.100.100, 

ssh user@192.168.25.100

this would get me to server B with ssh

what if i want to connect to server b directly? how can i do that?

example:

from my oc:

ssh@192.168.25.100

i have tried the following:

ssh -L 22:localhost:22 user@100.100.100.100

without success

tom91136
  • 493
  • 1
  • 4
  • 7

6 Answers6

35

Your problem is in binding a listener to localhost:22; there's already an sshd listening on that. Tunnelling an ssh connection through an ssh connection is completely lawful, and I do it all the time, but you need to pick unused ports for your forwarding listeners.

Try

me% ssh user@100.100.100.100 -L 2201:192.168.25.100:22

then

me% ssh localhost -p 2201

You should end up on server B (unless something's already bound to me:2201, in which case, pick another port).

MadHatter
  • 78,442
  • 20
  • 178
  • 229
  • thanks for the quick reply! it does work, however, how i can forward all connections instead of only ssh(22)? – tom91136 Dec 15 '11 at 12:00
  • 1
    That's a full-blown VPN you're looking for, not just port-forwarding. There's a writeup on how to do vpn-over-ssh at http://bodhizazen.net/Tutorials/VPN-Over-SSH , but it requires remote root access via ssh on A. Or you could look into OpenVPN or other VPN solutions, but again, you'll need privilege on A to make these work. – MadHatter Dec 15 '11 at 12:06
  • thanks a lot, one last thing, what if i only want to connect to A? – tom91136 Dec 15 '11 at 12:12
  • `me% ssh user@100.100.100.100` ; didn't we already cover that? or do you mean "what if I want a full-blown VPN to A?", in which case my answer stands. – MadHatter Dec 15 '11 at 12:19
  • the vpn one, everything works like a charm! thanks! – tom91136 Dec 15 '11 at 13:24
  • 1
    For people who want VPN over SSH, don't have root access on the server but it does have Python, try [sshuttle](https://github.com/apenwarr/sshuttle). – André Paramés Dec 15 '11 at 15:50
  • Love this answer! My localhost was able to login to "server B" root with an ssh key! Thumbs way the hell up! – Malachi Bazar Jun 03 '18 at 20:40
32

You don't have to use ssh port forwarding to ssh into an internal computer through a proxy. You can use the ssh feature of executing a command on the first server you connect to in order to ssh into a 3rd computer.

ssh -t user@100.100.100.100 ssh user@192.168.25.100

The -t option forces ssh to allocate a pseudo-tty so you can run an interactive command.

This can work with ssh keys as well. If you have your private and public key on machine A and your public key in the authorized keys files on machines B and C, then you can use the -A option to forward the authentication agent connection.

Jeff Strunk
  • 2,107
  • 1
  • 24
  • 29
  • 3
    Use `-A` with caution and only if the jump host is fully trusted. A safer and simpler alternative is to use `ssh -J jumphost destination` if the `-J` option is available. – coldfix Aug 10 '20 at 16:01
16

As of OpenSSH 7.3 (late 2016) the easiest way is the ProxyJump setting. In your ~/.ssh/config:

Host B
  ProxyJump A

Or on the command line, -J B.

arantius
  • 291
  • 2
  • 6
11

I used a different solution. I used a ProxyCommand option (here in ~/.ssh/config):

Host myinsidehost1 myinsidehost2 myinsidehost3
ProxyCommand ssh externalhost ssh %h sshd -i

This doesn't set up any port-to-port tunnel, instead tunnels ssh by using standard stdin/out. This method has a drawback that there are actually three ssh connections to authenticate. But to connect to the internal host you just type:

ssh myinsidehost2

...so you do not need to care about choosing any IP for that tunnel.

liori
  • 737
  • 3
  • 14
  • 1
    This is the only kind of SSH stacking that I find working. I've been tried `corkscrew` or `nc` (`netcat`) but none work as seamlessly as this. – Phuong Nguyen Sep 16 '14 at 16:38
8

according to the ssh man page, ProxyCommand is the correct method

the syntax being:

ProxyCommand ssh -W %h:%p user@jumphost 2> /dev/null
sebix
  • 4,175
  • 2
  • 25
  • 45
packeteer
  • 81
  • 1
  • 1
  • I am not sure the `-W` option existed when this question was answered. But with newer versions of the ssh client, I agree that the combination of `ProxyCommand` and `-W` is the preferred method. Maybe add some context showing both how it can be used on the command line as well as an example of a section for `.ssh/config`. – kasperd Jul 21 '15 at 08:18
  • Any idea where to find the changelogs/version info that tells us which versions of SSH have the `-W` command and which don't? A bit of googling did not yield answers quickly for me... – dmh Aug 01 '17 at 13:01
  • `-W` got introduced with OpenSSH 5.4, released in 2010. So the answer is yes @kasperd – 0xC0000022L Mar 27 '18 at 19:59
3

While ProxyJump has already been mentioned, it's most useful for static hosts you keep connecting to. If the machines keep changing, it's much easier to use -J (jump host) command line argument:

Once you know what it's doing, the syntax is pretty straightforward:

ssh -J user1@100.100.100.100 user2@192.168.25.100

The above command establishes a connection to 100.100.100.100 as user1, then from there "jumps" to 192.168.25.100 as user2

Jean Spector
  • 131
  • 3