I would like to use an intermediary host to tunnel between two other hosts which are both behind firewalls, and cannot accept incoming connections. For security reasons, I wish to avoid having any open sockets listening on any interfaces on the intermediary host.

I was thinking this could probably be accomplished using a combination of netcat and ssh, with netcat mediating the connection on the intermediary host using named pipes or unix domain sockets.

Both host-A and host-B can connect to intermediary-host using ssh.

I then want to set it up so that host-B can connect to host-A over the an ssh-netcat tunnel established on the intermediary host.

Here is a lame network diagram:

fw fw || [host-I] || [host-A]-->{ssh}-->||-----> [intermediary-host] <-----||<--{ssh}<--[host-B] <sshd on port 22> || {netcat + unix-socket-or-pipe} || <listen: 2222> /\ || / \ || {ssh -p 2222} \ || / \ || / \<---------==-----< / \ <---------==--</ || ||

So, I'm not sure how to invoke ssh+nc on each host to make this work.

  • Given the criteria you've stated in your question, it's not possible. Your A and B hosts can connect to the intermediary, C, but not to each other. You want A to get to B via C but you don't want anything listening on C. Therefore nothing can carry traffic from A to B (or B to A). You need something listening on C. It need only be on the local (internal) interface, but something must listen. And if something is listening on C then it's a standard proxy solution, of which we have several on this site. – roaima Mar 8 at 22:11
  • If you could control both ends then you could setup a single connection between them. But it wouldn't give you the ability to simply leave host A waiting for a connection, and log in from B whenever you want. – Philip Couling Mar 8 at 22:14
  • @PhilipCouling - I can access both ends simultaneously (one side via citrix) and I'm trying to get better remote access without the horrors of citrix+windows. So, I really only want a short term tunnel while my citrix session is active. So, how would I get the single connection between host-A and host-B via host-I? – Mylo Stone Mar 8 at 23:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.