Hot answers tagged

13

Using ssh is the easiest solution. ssh -g -L 8001:localhost:8000 -f -N user@remote-server.com This forwards the local port 8001 on your workstation to the localhost address on remote-server.com port 8000. -g means allow other clients on my network to connect to port 8001 on my workstation. Otherwise only local clients on your workstation can connect ...


12

With socat on the server: socat tcp-listen:8001,reuseaddr,fork tcp:localhost:8000


9

It's for tunneling software. See the wikipedia article titled: TUN/TAP for full details. excerpt from FreeBSD tun man page The tun interface is a software loopback mechanism that can be loosely described as the network interface analog of the pty(4), that is, tun does for network interfaces what the pty(4) driver does for terminals. This socat ...


7

That's a tricky thing to get done. Your best bet is to use some SOCKS redirector like socksify or redsocks, but none will give you what a VPN can, so you'd better set it up. VPN allows you to connect even whole networks, forward your traffic through secure channels, make your computers all appear as in one LAN and so on. You can use OpenVPN to do that - ...


7

As @slm has already written, a TUN interface is a software loopback that emulates a network interface the same as a TAP interface. In practical terms, a TUN interface is the emulation of a layer 3 interface. That is, it is a network layer emulation device that can tunnel data packets of varied nature, be it raw TCP, UDP, SCTP or encapsulated packets such as ...


6

OpenBSD netcat is available by default on Ubuntu and also on OS X. mkfifo a mkfifo b nc 127.0.0.1 8000 < b > a & nc -l 8001 < a > b & An alternative that works on OS X bash is to use a bidirectional pipe. It may work on other Unixes: nc 127.0.0.1 8000 <&1 | nc -l 8001 >&0


6

You can specify the interface through which to route traffic in the routing table: sudo route add <host.com> -interface <ppp0> Where host.com is the hostname or ip that you want to access through the interface, and ppp0 is the link identifier for your vpn shown with the ifconfig command.


6

It's not always "tunnel". TUN/TAP is just specific NIC drivers. From point of view of network stack they acts as any other network interfaces: they can have IP addresses, can be point-to-point or broadcast interfaces. Routing rules also applies to them. But all traffic that gets written to one of that network interfaces goes to some userspace program for ...


6

What you're looking for is called "ssh multi-hop". It is quite possible to do this transparently, using the ProxyCommand directive in .ssh/config (or an equivalent config option in PuTTY, or what-have-you): Host linux-server-b ProxyCommand ssh -q linux-server-a nc -q0 linux-server-b 22 What this does, when you try to connect to linux-server-b: opens ...


6

You have 2 options here. Option 1: Put ssh to listen on a different port, by editing the file /etc/ssh/sshd_config and changing the Port parameter to another number of port. Port 2222 as an example. Option 2: Redirect the traffic incoming from another port to tcp/22(ssh) iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT iptables -A INPUT -i eth0 -p ...


5

You would have to have them on unique ports. You can't have two applications listening simultaneously on a single port. So, in your example, because tunnels 1 and 2 both have an end on Site A, those endpoints must have unique ports. Hence the use of ports 1194, and 1195. Now, because the VPN links 1 and 2 are using unique ports 1194 and 1195 on A->B, and ...


5

I don't know if that's what you're looking for, but you can use ssh -D4545 domain.com to open a socks proxy tunnel at port 4545 to the desired machine from your computer. You can then set up that proxy in your application (say Firefox) and use a plugin to quickly engage and disengage the proxy settings (something like TorButton). There is one drawback ...


5

Try ssh -g -L ... From man ssh: -g Allows remote hosts to connect to local forwarded ports. If used on a multiplexed connection, then this option must be specified on the master process. From man ssh_config: GatewayPorts Specifies whether remote hosts are allowed to connect to local forwarded ports. By default, ssh(1) binds local port ...


5

I like to use sslh for this. It exploits the fact that different protocols start a connection differently. If it detects SSH, it forwards the connection to sshd and if it detects HTTPS it forwards the connection to httpd. This allows you to have e.g. nginx/apache and ssh listening on the same port (usually 443).


4

Try to run it via ssh socks proxy: echo 'Acquire::socks::proxy "socks://localhost:3128/";' | sudo tee -a /etc/apt/apt.conf ssh -CND localhost:3128 user@remote.host in another terminal session: sudo apt-get whatever you need


4

Using the traditional nc is the easiest solution: nc -l -p 8001 -c "nc 127.0.0.1 8000" This version of nc is in the netcat-traditional package on Ubuntu. (You have to update-alternatives or call it nc.traditional.) Note that in contrast to ssh this is not encrypted. Keep that in mind if you use it outside one host.


4

Why doesn't that solution with ProxyCommand work for X11 forwarding? I think you can directly reach mum's computer with X11 forwarding using the following configuration. Host mum ProxyCommand ssh -q -W localhost:1993 login@vps0 ForwardX11 yes


4

You must contact whoever is in charge of the network, and convince them that your access request is legitimate. Regardless of the sanity of the access restrictions, circumventing them will at the very least land you in hot water with your boss, and could even be taken as "hacking" and get you prosecuted.


3

Recent versions of OpenSSH support tun/tap network devices for true VPN support. See https://help.ubuntu.com/community/SSH_VPN for some basic documentation (obviously intended for Ubuntu, but the basic principle applies elsewhere.)


3

Your approach is not taking in account that contrary to other common protocolos, FTP uses both port 20 and port 21 over TCP. The term passive refers that the protocol is a little more well behaved than the initial implementations. Here is a link: http://www.slacksite.com/other/ftp.html Port 20/TCP is used for data, and port 21/TCP for commands. In ...


2

This was easier than I thought! All one has to do is bind the port 2048 of serverC to a port on pcA. For simplicity I use the same port number 2048: user@pcA $ ssh -L 2048:localhost:2048 user@serverC One needs to keep this terminal window open. Then, mounting the directory pcB:/home/user locally on pcA looks like this: sshfs -o port=2048 ...


2

Of course it's possible. The configuration you might want to try is tap rather than tun if you wonder about that, even though it might bit a bit harder to configure, it's easier to get hosts together in one network that way. You might need to enable client-to-client connections for that - there is a line for that commented out in example OpenVPN configs. ...


2

The problem is your (default changing) setting client=yes But you need stunnel in server mode, i.e. an SSL/TLS connection is offered to the outside and forwarded as an unencrypted connection.


2

There are a few things involved here. Output from the local box uses the OUTPUT table, not PREROUTING. PREROUTING is for traffic flowing through the box. The iptables rule only matches when a packet is sent. When the client opens a connection, it has to bind to an address before a single packet is generated. When it binds, it picks the source address ...


2

Second case is very useful in situation when example.com can connect to [google.com] host while your box can't. For example, you have VPN connection which is restricted to a number of boxes, while you want to access host not in list. ssh -L 123:target.host.com:456 user@vpn.host.com. So, basic usage is to jump INSIDE the network or jump OUTSIDE the network ...


2

If you understand what is going on in X11 forwarding, you will know that it is not so simple as described in the answer from @yaegashi. X11 forwarding is creating another layer under the ssh and it can't be chained as normal terminal data streams. But you are able to do it using port forwarding: Based on this blog post, which does it as hardcoding in shell ...


2

The -s flag tells ssh that instead of allocating a tty on the remote computer to use the subsystem specified as the remote command. What you're doing is establishing an ssh session using app as the subsystem similar to how things would work if the remote subsystem were sftp, for example.


2

redir is far more appropriate than nc for redirecting ports. While nc is more lightweight and appropriate for one-shot tests, for more serious use redir is more appropriate; nc also does not lends itself to handle reconnections or errors without the support of auxiliary tools and more complicated setups like having xinetd. redir is also a very lightweight ...


2

You will need both sets of rules within iptables. The two rulesets ensure that traffic leaving by the specified interfaces is appropriately masqueraded. Here is my suggestion, which is a little simpler than yours: # Masquerade outgoing traffic iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE # Allow ...


1

Well... first I'll answer with a different question: Since you can hit the ports you need on HOP from LOCAL, why not just have TightVNC Viewer connect directly to HOP:PORT? From a connectivity perspective, you shouldn't need to. Second (answering your original question), if you want to make sure that you're encrypting the session the entire way (completely ...



Only top voted, non community-wiki answers of a minimum length are eligible