1

Here's the scenario: I have 4 hosts.

  • Client/localhost
  • AWS bastion host (port 22 only)
  • EC2 Instance with graphical desktop (private subnet)
  • EC2 Instance (no graphical) with Docker running a WebLogic Server container

Problem: I need to be able to access that WebLogic server via internet browser through the bastion host. Now I can only use port 22 to the bastion host but all outgoing connections are enabled.

My idea was to use TightVNC viewer and SSH tunnel through the bastion host to the GUI instance.

Now my issues is I don't know how to get my bastion host to forward incoming port 22 for my user to the destination port 5905, in my case. I do not have root access on the bastion host.

All of the solutions I've found so far involve SSHing via command line, not using VNC. I need the bastion to automatically forward port 22 traffic to the VNC port, for my user only if possible but not 100% required.

public                 public                 private                private
[user/client] --22-->[bastion]--VNC:5905-->[VNC Server]--80/443-->[Docker/WLS]
GUI                     CLI                     GUI                    CLI
Improve this question
2
  • Are you able to make any changes at all on bastion? Have you looked at running autossh on bastion? Not sure if you have rights to even set it up on that server.
    – saleetzo
    Commented Mar 16, 2018 at 23:17
  • I do have some rights, just not with sudo privileges. I do have permissions for my home directory like ~.ssh/. I wasn't aware of autossh but I will look into that.
    – Greg
    Commented Mar 16, 2018 at 23:21

2 Answers 2

Reset to default
2

This should be a pretty normal ssh -L 5905:vnchost:5905 user@bastionhost, followed by vncviewer localhost:5905 on the public client system, unless the bastion server is explicitly disabling SSH tunneling or there is firewalling between it and the VNC server host.

The -L 5905:vnchost:5905 (alternately written -L localhost:5905:vnchost:5905) parameter means that the ssh client node will open a port on localhost:5905 and the SSH server daemon on the bastion host should try to send the tunnel to vnchost:5905 when the VNC viewer on the client side tries to initiate a connection.

If the connection can't be made, an error message should appear in the SSH session (and the VNC client will probably throw an error too).

Improve this answer
0

I have the same setup and achieve it via the below, where bastion is hostname of the bastion and 10.1.1.1 is the ec2 instance

ssh -v -l user -L 5901:localhost:5901 bastion ssh -o StrictHostKeyChecking=no -L 5901:localhost:5901 -N [email protected]

and then vnc to localhost:5901

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .