Reverse SSH Tunnel

Question

I have a gitlab server on my local network and a server that I can ssh to from outside my network.

Is there a way I can configure the server, that I can SSH into, so that when I use:

ssh [email protected]

It sends that to the Gitlab server on the local network? Kind of like an Nginx reverse proxy but with ssh.

Edit:

I've been looking around and I found something here that looks like what I want.

Access via Load Balancer

If you want to provide a more standard git experience you can manually > set up and configure an external load balancer to point to a given GitLab node. This should route traffic from port 22 to port 2222 on the > GitLab node. You can then point a DNS record at the load balancer.

This looks like what I am trying to do, but how do I accomplish this?

Edit 2:

Here is an image that can hopefully clarify what I am trying to do.

(Those red lines should be going through the internet too.)

Answer 1

HTTP servers like nginx are able to proxy based on the hostname because it is sent in the HTTP/1.1 Host header of the request. SSH does not have this concept of virtual hosts, the client not send the hostname at all.

You have three options:

• Use port forwarding to make your gitlab server directly available.
• Make your gitlab server available through an (additional) IPv4 or IPv6 address.
• Create a SSH tunnel into your network and proxy the SSH connection to your git server through this tunnel.

Port forwarding

This is probably the easiest approach that does interfere with the "public server". Setup your gateway to forward port 2222 to 192.168.2.26:22. Then use the ssh -p2222 [email protected] to connect. For git, use URLs like ssh://[email protected]:2222/repo.git.

Alternatively, you can just use ssh://[email protected]/repo.git or [email protected]:repo.git if you create a ~/.ssh/config file with:

Host git.example.com
    Port 2222

Additional IPv4 or IPv6 address

If you have a home network, getting an IPv4 address is probably impossible, but some business providers do it. If your network supports IPv6 (end-to-end), then you can just use normal routing without nasty proxying or NAT hackery.

SSH tunnel

You can use the ProxyCommand option to specify the command that proxies the SSH connection to git.example.com. In your case, the "public server" is the proxy, so the command should be connecting to that server.

Let's start with the configuration snippet for ~/.ssh/config:

Host git.example.com
    ProxyCommand ssh -W %h:%p [email protected]

In this snippet the -W %h:%p option will be expanded to -W git.example.com:22 and redirect standard input and output to said host (git.example.com). This enables your local SSH client to speak with your gitlab server. You can again use any URL like [email protected]:repo.git, the proxy will be transparant to the git client.