How to ssh to an unreachable remote machine by tunneling through a server that everyone can reach?

Question

Machines:

• Let's call my machine macbook.
• I have a server on tah interwebs. Call it server.
• I have a Mac Mini elsewhere that I can access via iChat screen sharing. Let's call it mini.

Reachability:

• server can see neither macbook nor mini.
• macbook can see server but not mini.
• mini can see server, but not macbook.

Screen sharing is slow. I want an SSH connection to mini. A direct connection is impossible because of routers, NAT, etc.

What I want to do is to connect both macbook and mini to server via SSH, creating the approriate tunnels, so that from macbook I can run a ssh … command to connect to mini by tunneling the connection through server.

So my question is, what commands do I have to run, on which machines, to make this work?

To keep it simple, please use server, mini, macbook as hostnames in your answers.

Answer 1

Only one ssh tunnel is needed. From the mini:

ssh -N -R 0.0.0.0:8022:localhost:22 serverUser@server

Now you can just connect from macbook onto server with ssh -p 8022 miniUser@server

Be sure to have GatewayPorts set to yes in the server's /etc/ssh/sshd_config.

Additionally you may want to define some stuff in ~/.ssh/config:

Host gate.mini
    HostName server
    Port 8022
    HostKeyAlias mini

This allows you to do the more coherent ssh [e-mail], and at the same time not be bothered with server fingerprint mismatches.

Answer 2

On the Mac Mini do:

ssh -R 1234:localhost:22 serverUser@server

This will forward connections to port 1234 of the server to port 22 on the Mac Mini.

Then, on the MacBook do:

ssh -L 1235:localhost:1234 serverUser@server

This will forward connections to port 1235 on the MacBook to port 1234 on the server (which will then get forwarded to the Mac Mini by the above command).

Finally, to get your actual connection, on the MacBook do:

ssh -p 1235 miniUser@localhost

Which connects to port 1235 on the MacBook, which gets forwarded to port 1234 on the server, which gets forwarded to port 22 on the Mac Mini. Ports 1234 and 1235 can be set to more or less whatever you like - and can be the same (I used different numbers to make the explanation more clear). Similarly, port 22 should be changed if SSH on your Mac Mini is listening on a different port.

Answer 3

You can tunnel any command through an ssh session. That means you can also tunnel a ssh command through ssh.

This would look like this:

ssh -t [e-mail] ssh [e-mail]

This opens an ssh session to server and from there instantly opens a second ssh session to mini. With an ssh tunnel this should work without problems from your macbook machine. At least given that mini is reachable from server.

Requirements:

• ssh on macbook
• ssh server and ssh client on server
• ssh server and ssh client on mini

It might be nifty to make an alias so you don't have to type this every time you want to connect. Also think about password less connection to server so you don't have to enter 2 passwords for this tunneled connection.