3

From a server 192.168.0.1, I'd like to reach a server 192.168.0.2 on port 80.

192.168.0.2 can reach 192.168.0.1, but 192.168.0.1 can't reach 192.168.0.2 (firewall).

I have set up a reverse proxy, by typing the following command on 192.168.0.2:

ssh -f -N -T -R0.0.0.0:80:localhost:80 192.168.0.1

now 192.168.0.1 can reach 192.168.0.2, with the following command:

wget localhost:80

However I'd like to be able to reach 192.168.0.2 by taping

wget 192.168.0.2:80

Is this possible, without messing with the DNS?

3
  • 1
  • @7171u ok thanks, I have added a rule so that iptables -t nat -L shows: DNAT tcp -- anywhere 192.168.0.2 tcp dpt:http to:127.0.0.1:80 however, the second wget is still not working, what could be wrong?
    – rogerJ
    Commented Mar 1, 2016 at 14:32
  • I have used this on RHEL7 and it works fine.
    – jijinp
    Commented Mar 1, 2016 at 15:01

2 Answers 2

0

You need to define the GatewayPorts in sshd_config otherwise the * or 0.0.0.0 will bind only to the loopback interface.

Also note that

Privileged ports can be forwarded only when logging in as root on the remote machine.

From manual page for ssh:

By default, TCP listening sockets on the server will be bound to the loopback interface only. This may be overridden by specifying a bind_address. An empty bind_address, or the address ‘*’, indicates that the remote socket should listen on all interfaces. Specifying a remote bind_address will only succeed if the server's GatewayPorts option is enabled (see sshd_config(5)).

6
  • I have added the following line in /etc/ssh/sshd.config -> GatewayPorts clientspecified. However it still doesn't work.
    – rogerJ
    Commented Mar 1, 2016 at 16:12
  • Also I would try with * or address of outer interface (192.168.0.1) instead of 0.0.0.0 and I would watch for errors on both connections.
    – Jakuje
    Commented Mar 1, 2016 at 16:27
  • I tried both * and 192.168.0.1, to no success. I don't really know what errors to look for, the only thing I can tell you is that the tunnel itself works (wget localhost:80), as explained in the question, so the error is probably not coming from here. What doesn't work is just the wget 192.168.0.2:80, which is maybe an error with the iptables rule
    – rogerJ
    Commented Mar 1, 2016 at 16:42
  • Why do you try wget 192.168.0.2:80? You should try wget 192.168.0.1:80. This is where your port is forwarded, isn't it?
    – Jakuje
    Commented Mar 1, 2016 at 16:54
  • Well that's the whole point of my question. Say the server I would like to access is google.com, but I can't reach it directly, though google.com can reach me, I'd like to set up my network so that I can reach google.com transparently without having to change anything. So in the end of this configuration, I expect to be able to type wget google.com, not wget localhost or wget 192.168.0.1, which is my own ip.
    – rogerJ
    Commented Mar 1, 2016 at 17:06
0

I was struggling with this issue on Ubuntu 14.04 (I tried both GatewayPorts clientspecified and GatewayPorts yes in /etc/ssh/sshd_config).

Instead, adding this to my sshd_config worked:

Match User !root
    GatewayPorts yes

That is, I had to specify a user to match the rule to.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .