2

I have VM hosting machine which is providing multiple VMs. Each VM has own ports range forwarded and each VM exposes VNC. The problem is host has only 1 public IP and VMs are distinguished basing on port range. http and https is easy because nginx can be used to perform hostname based routing. But one of users is behind firewalled network which allows only port 22, 80 and 443 so he can't connect to VM at all because his ssh port is blocked.

Is it possible to set up SSH router/proxy allowing to jump to VMs without actually creating functional accounts for each user on VM hosting machine?

  • I came across this: github.com/mhzed/wstunnel It's definitely not production grade software but well... over-firewalled networks are not either so I guess it counts. As it's ws should work correctly through nginx and installation of proxy server would be user decision so sounds good to me - TCP over http basically... – Lapsio Mar 5 '17 at 19:29
3

I love using zerotier (free version for me atm) to create my own private networks. I use it to traverse NAT and configuration is done on the webUI. It works like a virtual private network (closest tool I know is hamachi) and it is also possible to create virtual public networks.

It can create virtual Ethernet networks of almost unlimited size.

You run zt as a client and your system will have a virtual network "zt" interface. Then you create your own network environment and authorize the 'clients' in the webui (for private networks). Every client will then get it's own IP address (or multiple, according to your config) connected on the virtual 'zt' interface.

It works by creating a virtual zt network interface for every joined network (zt0, zt1, etc with the IPs you assign it to (multiple IPs are possible per interface). Networks can be private or public.

edit: This is indeed not a direct answer to the question about jumphosts, but it's an alternative solution by eliminating the need to forward ports. Instead of forwarding each vnc instance to it's own port range, with zt you can just assign a individual IP to each vm instance in your own private network, running on a default port.

  • unfortunately it turns out hotel network allows only ports 80 and 443. So it doesn't allow port 9333 used by zt or any other port required by any VPN. And there's only 1 public IP and server is actually providing http and https servers to world already. I'm afraid websockets+nginx magic is absolutely the only way :/ Plus I'm not sure how this answer is related to question in the first place.... – Lapsio Mar 6 '17 at 0:34
  • oooh I see how it's related, zt tunnels through their servers over https if there's hardcore firewall in between. – Lapsio Mar 6 '17 at 0:44
  • I've edited my answer, at first it's hard to understand how zt works, but it's just a very elegant solution for me to be able to connect to my servers by using it's own virtual network. It's kind of like hamachi (if you've ever heard of that), but more developer oriented. – hyph Mar 6 '17 at 0:47
2

If you want to use a jumphost, set their shell to /bin/false. There are likely other security concerns you need to address as well. For example, you should disable GatewayPorts on the jumphost, and also somehow prevent tunnels without preventing the -W to the destination host.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.