SSH Tunnel Between Multiple Hosts

Question

This is slightly different than the other SSH questions I have seen on here so here it goes. I have a complex setup for accessing a web application and unfortunately there is no way around it. Here is the scenario and systems involved (IP addresses anonymized for obvious reasons):

System Alpha
System Bravo
System Charlie
System Delta

I need to communicate to a website available to System Delta from System Alpha. The problem is, I cannot talk to System Delta directly. Currently, I can SSH in to System Bravo, and I can SSH into System Charlie utilizing a proxy command which utilizes System Bravo as the proxy. To illustrate this, here is my SSH Config:

Host system.bravo
  User bob
  Hostname 1.1.1.1
  ForwardAgent yes

Host system.charlie
  User bob
  ForwardAgent yes
  ProxyCommand ssh -q system.bravo nc localhost 1081

System Charlie is accessible to System Alpha in this way because it has created a reverse SSH tunnel to System Bravo on port 1081. This is done because the firewall sitting between System Bravo and System Charlie ONLY allows SSH outbound to System Bravo. I know this is annoying, but it is a client requirement.

System Charlie can SSH into System Delta without issue. My problem is, how do I go about setting up a usable SOCKS proxy with SSH so that System Alpha can access a website only accessible from System Delta. Normally I would do it like this:

ssh -2 -C -D 4001 -L 4002:localhost:4002 -L 4003:localhost:4003 [email protected]
ssh -2 -C -D 4002 -L 4003:localhost:4003 [email protected]
ssh -2 -C -D 4003 [email protected]

Then I would simply point Firefox to localhost:4003 and that would be my working proxy to access the website. However, because of the weird setup between System Bravo and System Charlie this will not work. ***It was pointed out to me a diagram displaying communications would make this easier. So here it is:

A full list of possible connections:
     ----->      --X-->       ----->
Alpha       Bravo      Charlie      Delta
     <--X--      <-----       <--X--

The connection between Alpha and Bravo and Charlie as it is currently 
configured:

     ProxyCommand ssh -q system.bravo nc localhost 1081
     -------------------------------------------------->      
Alpha    Bravo <---------------------------------------- Charlie
                      AUTOSSH -R 1081:localhost:22 

-----> = An allowed connection via SSH
--X--> = A blocked connection, only reverse SSH possible

Does anyone have a solution on how I can accomplish this keeping in mind the required proxy command and reverse SSH tunnel between System Bravo and System Charlie?

Thanks so much

PS: I hope my diagram helps, sorry that it is not a real image

Answer 1

Seems like if you can (from A) ssh to C, you can do:

user@Alpha:~$ ssh -L1234:localhost:1234 Charlie
user@Charlie:~$ ssh -Dlocalhost:1234 Delta

... and at that point, you can have Firefox use localhost:1234 as a SOCKS proxy. The local SSH will proxy that over the tunnel to C, where that ssh is listening as a SOCKS server and will forward it to D.

But really, I'd push back on your client: if they expect you to access sites from A, they ought to provide a sane method to do so. Like a VPN, for example.