Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

There are certain websites/services which I can only access from the subnet on which my server is located (think of the typical intranet scenario). Is there a way to transparently route traffic that go to these addresses through an SSH tunnel?

Consider the following setup:

My laptop is connected on the home network. It cannot access services on ips X and Y directly. I have an SSH tunnel to a server which is on a subnet that can actually access these services.

Can I somehow automatically encapsulate all the traffic to the subnets of X and Y to go through this tunnel, without having to run the entire VPN solution that would send all my traffic through the server? In other words: all traffic that goes to any other subnet should still go directly from the laptop, without passing through the server (using the tunnel).

share|improve this question
add comment

5 Answers

You can specify the interface through which to route traffic in the routing table:

sudo route add <host.com> -interface <ppp0>

Where host.com is the hostname or ip that you want to access through the interface, and ppp0 is the link identifier for your vpn shown with the ifconfig command.

share|improve this answer
add comment

Disclaimer: I have not actually tested what I'm going to describe, and indeed it can be completely wrong, but your question is so intriguing that I cannot resist the temptation to draft an answer. :-) Also, the setup here depends on some iptables functionality that might exist only on Linux.

Assuming you want to connect from your laptop to a specific port P1 on server X1, to port P2 on server X2, etc. -- I am going to describe how to route TCP traffic to these specific server+port pairs through an SSH tunnel. Note: the IP addresses X1,X2,etc are the IP addresses of server as seen from the gateway host (the one you SSH into).

  1. Select some unused local ports L1 (e.g. 10000), L2 (e.g. 10001), etc. Ports L1, L2, ..., must be all distinct and their number should be equal to the number of distinct (Xn,Pn) server+port pairs.

  2. Use iptables to redirect packets directed to Xn:Pn onto localhost:Ln

    iptables -t nat -A OUTPUT -p tcp -d X1 --dport P1 -j DNAT --to-destination localhost:L1 iptables -t nat -A OUTPUT -p tcp -d X2 --dport P2 -j DNAT --to-destination localhost:L2

  3. Now SSH to the gateway, using the -L option to tunnel traffic from localhost:Ln to (Xn, Pn):

    ssh gateway.server -L localhost:L1:X1:P1 -L localhost:L2:X2:P2 ...

Example:

# access webserver.intranet (port 80) through localhost:10080
iptables -t nat -A OUTPUT -p tcp -d webserver.intranet --dport 80 -j DNAT --to-destination localhost:10080
ssh gateway.server -L locahost:10080:webserver.intranet:80

Caveats:

  • it only works for TCP, if it works at all...

  • if you want to access more than one server, it's probably less work to setup a VPN

  • it might still be easier to use SSH -D option to simulate a SOCKS proxy and tunnel all your traffic through that.

share|improve this answer
add comment

subnets of X and Y to go through this tunnel, without having to run the entire VPN solution that would send all my traffic through the server?

What you want is the definition of a VPN.

A VPN should not

send all [your] traffic through the server?

If it is, it is not setup properly.

It is assumed that any machine your trying to get access to via a Tunnel or VPN, by definition, not accessible via the Internet. So, only the needed, non-Internet routable address should be routed down the VPN.

If you have a more complicated situation, like only machine X and Y and nothing else. Your IT staff can put those on a subnet for you. Then on your client computer, only route that subnet down the VPN.

share|improve this answer
add comment

Recent versions of OpenSSH support tun/tap network devices for true VPN support. See https://help.ubuntu.com/community/SSH_VPN for some basic documentation (obviously intended for Ubuntu, but the basic principle applies elsewhere.)

share|improve this answer
    
Note that this requires root privileges on both the laptop and the gateway host. –  Riccardo Murri Aug 12 '10 at 11:50
add comment

Can I somehow automatically encapsulate all the traffic to the subnets of X and Y to go through this tunnel, without having to run the entire VPN solution that would send all my traffic through the server?

This is a bit strange at first glance because that's what a VPN will do for you. SSH tends to be a point-to-point affair, the idea being that you connect one port on your local machine to the port of a remote machine elsewhere; it really wasn't designed for the type of traffic you envision.

In other words: all traffic that goes to any other subnet should still go directly from the laptop, without passing through the server (using the tunnel).

Again, a VPN would take care of that.

If you are concerned about a "heavyweight" solution to getting secure VPN traffic (i.e. you don't want to monkey with it because it would be too complicated) you should really look at OpenVPN, which will do exactly what you are describing. No only would it encapsulate all of the traffic, but it can be done in a way that only traffic destined for those subnets will make the trip over the VPN pipe. I will warn you that you will still need to edit a text file on the local and remote machine(s), but it's fairly easy to get running.

For your purposes, because you do not want the party in the middle (a server) to see your traffic, you would set up the VPN to connect directly from your machine to the remote machine. Any routed packets would be encrypted before leaving your laptop, so you would have 100% end-to-end coverage.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.