We have a cluster (currently 10 machines) behind a NAT. There is a NAT gateway/jump-host between the private network and the regular company network.
ssh to the jump-host and then get into any other machine behind the NAT.
I would like to provide an easy script which helps them to tunnel web interfaces behind the NAT to their local machines.
So my first suggestions was: using a SSH socks proxy and tunnel the interfaces to their localhost.
So my question is: If I create these two tunnels (one from the local computer of my co-workers to the jump-host, and the one from the jump-host to the corresponding machine behind the NAT) - how secure is this tunnel?
worker1 which is doing this:
ssh -t email@example.com -L 10001:localhost:33388 ssh -t hostxyz.behindnat.tld
There is an open port 33388 on the jump-host machine which is listening on the loopback interface. If
worker2 just logs into the jump-host and uses the localhost port 33388 as well for the already tunneled connection, he must not authenticate again to the
This seems like a huge security flaw to me, is there a better solution?