8

I've recently converted my home development machine to Linux, and would like to be able to log into it from work if needed. I use a mixture of Linux and Windows machines, and I already have various gyrations of ssh/putty/Xorg/Cygwin/etc set up to launch X clients remotely and display on the local X server.

My problem is, my home machines are behind a firewall, and getting to them requires tunneling through the firewall over ssh. When I was running Windows I had set up ssh port forwarding on the firewall to bounce RDC connections to the correct machine, but it appears that X tunneling is more complex. Just enabling X11 forwarding on the ssh connection to the firewall only seems to work for X clients running on that machine, not ones I start on the second "hop".

Is there a way to forward/tunnel/whatever the X11 connection through the firewall and to a remote machine that's an extra hop away?

Side-Note:

I'm not particularly married to X11, so if there's some other option that will work better over multiple ssh hops, I'd take that as an answer (especially if you can tell me why it's better). I just happen to already have an Xorg-ish server on all of my work machines. The requirements are basically:

  • Display-side-thingee (X server, RDC client, etc.) needs to run on Linux and Windows
  • Application-side stuff just needs to run on Linux
  • Needs to work over an ssh "tunnel" of at least 2 two hops.
Improve this question

1 Answer 1

Reset to default
12

Lets suppose that you have the following topology:

Work -> Firewall (port forwarding) -> Server -> Target.

If your problem is that you are not getting the X11 on Target because you are doing ssh -X Server and then inside Server you are doing ssh -X Target this might work for you.

ssh allows you to forward ports too. You can use a ssh connection to get a remote port mapped in a local port. For example to access Target one can:

Map the port 22 on Target to a local port 20000 using the Server connection (keep this connection open or use -Nf option).

ssh -L20000:Target:22 Server

Then connect to Target using this mapped port.

ssh -p 20000 -X localhost

Improve this answer
5
  • Just to make sure I understand, this is setting up an ssh tunnel directly to the target machine so it only looks to X like one hop? That sounds like it should work, I'll let you know...
    – KutuluMike
    Commented Jan 6, 2014 at 17:30
  • Yes. Exactly. You are taking a remote port using a server as a bridge and mapping it to a local port. SSH allows you to do such things with -L (remote to local), -R (local ro remote) and -D (create a kind of proxy).
    – Vinicius Tinti
    Commented Jan 6, 2014 at 17:37
  • This is a useful technique, ando ften the best option, but be aware of the performance problems in running TCP over TCP when you have packet loss.
    – mc0e
    Commented Oct 18, 2014 at 5:10
  • The connection between Target and Server here is secure or not? As I understand, this might be a problem?
    – Syrtis Major
    Commented Oct 23, 2015 at 8:39
  • 1
    @SyrtisMajor as secure as an ssh connection since the data is being transported by ssh protocol.
    – Vinicius Tinti
    Commented Nov 30, 2015 at 11:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .