We have a cluster (currently 10 machines) behind a NAT. There is a NAT gateway/jump-host between the private network and the regular company network.

Users can ssh to the jump-host and then get into any other machine behind the NAT.

I would like to provide an easy script which helps them to tunnel web interfaces behind the NAT to their local machines.

So my first suggestions was: using a SSH socks proxy and tunnel the interfaces to their localhost.

So my question is: If I create these two tunnels (one from the local computer of my co-workers to the jump-host, and the one from the jump-host to the corresponding machine behind the NAT) - how secure is this tunnel?

Imagine worker1 which is doing this:

ssh -t user@jumphost.tld -L 10001:localhost:33388 ssh -t hostxyz.behindnat.tld

There is an open port 33388 on the jump-host machine which is listening on the loopback interface. If worker2 just logs into the jump-host and uses the localhost port 33388 as well for the already tunneled connection, he must not authenticate again to the hostxyz.behindnat.tld, right?

This seems like a huge security flaw to me, is there a better solution?

  • Use vpn instead. Jumping over hosts with ssh is not too effective or comfortable. – Ipor Sircer Nov 21 '17 at 13:23
  • This always seemd like an overkill for just one port which has to exposed to the users. Its quite charming to put this command into a bash / batch and let the users just authenticate and than use the interface that easy. If using a vpn I have to take care of routing and stuff :-S – Smoki Nov 21 '17 at 13:30

I assume your scenario implies a preexisting ssh session between jumphost and hostxyz, which would be open to all with access to jumphost’s listening port.

You mentioned socks and tunnel, which are technically two different things.

Setup worker1’s socks proxy like this: ssh user@jumphost.tld -D

Set worker1’s browser to use socks localhost:10001 to browse via jumphost.tld

If you want to ssh directly from worker1 to hostxyz, you could do something like the following.

  ssh user@jumphost.tld -L localhost:10001:hostxyz:22
  ssh user@localhost:10001

This is what I do. I use an .ssh/config file to keep everything organized. I recommend reading the following for info on the config file and tunneling. https://man.openbsd.org/ssh_config Watch Michael W Lucas talk on openssh for an other good primer.

  • Ahh okay, but exactly this seems a little insecure to me: Lets assume a authentication has to be done at host "hostxyz" - YOU will be prompted for an authentication, but if another worker can login into the jumphost, he can use your opend port 10001 to get a already authenticated connection to hosxyz, right? – Smoki Nov 22 '17 at 12:55
  • In my example, 10001 is listening on worker1’s loopback address (, not the jumphost. Anyone logged in to worker1’s computer can reach that address. But not everyone logged into the jumphost. – CoreyJJohnson Nov 25 '17 at 15:16
  • When you say authentication, are you talking about ssh to hostxyz or web auth or something else? – CoreyJJohnson Nov 25 '17 at 15:18
  • Run the commands I mentioned on worker1's machine and run netstat -an | grep LISTEN on each machine and you'll see where the listening ports are. – CoreyJJohnson Nov 27 '17 at 16:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.