I have the Client machine living somewhere on the Internet, and it needs to access a custom port of Target machine (or, initially any port on any reachable machine, but, eventually, particular port, say, 12345, on Target) that lives inside a private network and accepts connections only from the machines inside that network.
| Client --X--> | Target:12345 | (the Internet) (private network)
The private network has a VPN server, but I have no root access on the Client, and I cannot use (Open)VPN there, and, hence, I have no easy access to the private network.
"Gate" without root
The first thing that, presumably, can help Client reach the Target is the Gate machine in the private network that is reachable from the outside world, and Target would accept TCP connections from Gate:
| Client --?--> Gate --ok--> Target:12345 |
The problem is to set up transparent TCP traffic forwarding at the Gate, so that the Client connecting to Gate[:some_port] would actually talk to Target:12345.
If I had root access at the Gate, I would use iptables to transparently forward TCP traffic coming to Gate[:chosen_port] to Target:12345. However, I do not have root access at Gate (though, I have a user-level access there and can SSH to it).
If I had an SSH access to Target, I would establish an SSH tunnel between Target and Gate, making Target reachable from Client through this tunnel; however, I do not have SSH access at Target (in fact, the only thing I can do with the Target is establishing TCP connection with its port 12345 from within the private network).
Is it possible to establish the above described TCP forwarding having no root at both Client and Gate and having no SSH access to Target? If the answer is no, then there is a follow-up question.
"Gate" without root + "Insider" with root
Besides the Gate, the private network has machine Insider where I do have root access.
| Client -ssh-> Gate -ssh-> Insider --?--> Target:12345 |
There is a reverse SSH tunnel established from Insider to Gate, so Client can SSH to Insider, and, theoretically, Insider can, then, ("manually") establish a TCP connection with Target's 12345 port. However, it is not exactly a transparent TCP traffic forwarding solution I am looking for.
In this latter situation, can my having root access at Insider help transparently forward traffic from Client to Target:12345?
Any suggestions are greatly appreciated!