1

I have established a reverse ssh tunnel into a restricted network to an aws server, i.e. to access it, I ssh into the aws server and from there I get access to the machine in the restricted network on some custom port.

On this restricted network, there are devices which can be configured through a web browser.

I believe I could do something like ssh -R 8080:deviceIP:80 user@aws to get it forwarded to aws machine but then I still can't access it (other than through remote X which is terribly slow). How can I pipe deviceIP:80 through to my browser at home via aws?

I've tried the above ssh command and then directed the brower on my home computer to aws:8080 but that didn't load any page...

Improve this question
0

2 Answers 2

Reset to default
5

SSH tunnels are useful to cross insecure networks, providing end-to-end encryption when connecting two end points that seat on distinct networks.

A far as I can tell (thanks to comments), what you have is:

  • A local host-A: your localhost, on your local network (likely behind firewall/NAT)

  • A publicly reachable host-B: the aws server

  • A non-publicly reachable host-C: on the restricted remote network (likely behind firewall/NAT)

  • A non-publicly reachable host-D: the one you refer to as deviceIP, that listens on port 80 and is on the remote restricted network

If you want to connect your host A to host D, letting your browser reach it on port 80, you need:

  1. A tunnel from host-A to host-B, that:

    • Lets host-A listen on port 8080

    • Sends traffic from that port through the tunnel

    • On host-B (aws), redirects the traffic coming from the tunnel to the local (i.e. on host-B) port 15872 (I took it from your comments; you can choose any available port; just make sure to use the same one in all commands)

    # Execute on host-A
$ ssh -L 8080:localhost:15872 user@host-B

  2. A tunnel from host-C to host-B, that:

    • Lets host-B listen on port 15872

    • Sends traffic from that port through the tunnel

    • On host-C (your Linux server), redirects that traffic to port 80 on host-D

    # Execute on host-C
$ ssh -R *:15872:host-D:80 user@host-B

This way, requests made to host-A on port 8080 will be tunneled to host-B, redirected to port 15872 on the same host-B, tunneled to host-C and redirected on host-C to port 80 of host-D.

Improve this answer
9
  • Ok, seems like I need something like $ ssh -L *:8080:deviceIP:80 user@localhost # run on awsonly that I don't have 'deviceIP' but instead a reverse tunnel on port '15872' to get access to the host in the restricted network.... so how do I need to modify this accordingly? Plus what do you mean by It's probably not the best way ? Is there a better way you know of?
    – stdcerr
    Commented Nov 7, 2018 at 13:06
  • 1
    @cerr About "It's probably not the best way", see my edited answer.
    – fra-san
    Commented Nov 7, 2018 at 13:17
  • 2
    @cerr Your network topology is not entirely clear to me. Are you actually trying to connect your host (A) to a non-directly reachable remote host (C) by establishing 2 different tunnels to a publicly available host (B)? As in "A -ssh> B <ssh- C"? If so, I'm sorry, I misunderstood your question - and I will update my answer.
    – fra-san
    Commented Nov 7, 2018 at 13:22
  • Yes pretty much, what I have is (A being my private computer, B the public reachable aws instance, C the Linux host in the restricted network, D the device I would like to reach in the restricted network). What I have going fine is A-ssh>B-reverse ssh>C. What I would like to add: A-http8080>B-reverse ssh>C-http80>D.
    – stdcerr
    Commented Nov 7, 2018 at 13:45
  • 1
    @cerr See edited answer.
    – fra-san
    Commented Nov 7, 2018 at 14:49
2

You don't redirect a webserver to your browser - you would redirect requests from your browser to the webserver. It's a forward proxy, not a reverse one that you need.

This will create a listening socket on your client port 8080, and route that forwards across the ssh tunnel to deviceIP port 80:

ssh -L 8080:deviceIP:80 user@aws
Improve this answer
7
  • But this won't forward requests sent to aws:8080 to deviceIP:80 - which is utltimately what I need.
    – stdcerr
    Commented Nov 6, 2018 at 14:19
  • That's not what you asked
    – Chris Davies
    Commented Nov 6, 2018 at 14:21
  • 1
    You don't pipe anything to your browser. You create a pipe, that your browser can reach, that forwards to the webserver.
    – Chris Davies
    Commented Nov 6, 2018 at 14:24
  • 1
    @cerr What creating a tunnel with ssh -R 8080:deviceIP:80 user@aws does: 1) aws listens on port 8080 (by default, loopback interface only); 2) traffic from a connection made to aws:8080 is tunneled to your local host; 3) your local host forwards it to deviceIP:80.
    – fra-san
    Commented Nov 6, 2018 at 14:58
  • 1
    @cerr I posted my own answer to clarify.
    – fra-san
    Commented Nov 7, 2018 at 10:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .