1

I want to implement a proxy which has two (A and B) servers in the middle. traffic goes from my computer to server B and then to server A and then gets the data. I found that with this configuration in ~/.ssh/config:

HOST B
    HostName B
    user debian
    DynamicForward 0.0.0.0:1081

I can use my 1081 port as a proxy. But now I don't know how to proxy all B's traffic through A.

This is my ssh version:

OpenSSH_7.2p2 Ubuntu-4ubuntu2.8, OpenSSL 1.0.2g 1 Mar 2016

2

B is just handling everything it gets to A. A must choose where to retrieve data depending on its data. Clearly only A should have the DynamicForward tunnel, the role of B is just an intermediate host for connectivity. Normally B should only require a classic LocalForward to present queries to A.

This could be done in different ways, but the most simple and secure method takes advantage of the ProxyJump feature which will show A as if it was directly reachable, thus not requiring anymore to ponder how B will interact with the intended port forwarding. One can consider B is almost invisible. So in the end, the configuration below can be put in ~/.ssh/config:

Host B
    User userb

Host A
    User usera
    ProxyJump B
    DynamicForward 1081

Invoked with only:

ssh A

Without configuration file the equivalent command line would be:

ssh -D 1081 -J userb@B usera@A

UPDATE: should ssh's version be older than 7.3 (as it appears to be for OP), ProxyJump can still be replaced by ProxyCommand + ssh -W like this:

as configuration file ~/.ssh/config:

Host B
    User userb

Host A
    User usera
    ProxyCommand ssh -W %h:%p B
    DynamicForward 1081

or without configuration file the equivalent command line:

ssh -D 1081 -o 'ProxyCommand ssh -W %h:%p userb@B' usera@A

The SOCKS5 API will be available on the client as localhost:1081 (unless putting back 0.0.0.0:1081 (or using GatewayPorts/-g) to make it available for other clients). Under the hood, handled by a pair of pipes, a spawned sub ssh process will establish a tunnel through Host B and will present A's ssh server to the initial ssh command: the whole ssh is tunneled that's why there's no specific additional port forwarding to be configured.

  • The first block of code should be written in ~/.ssh/config in my machine? – K47 Nov 22 '19 at 20:58
  • I get this error: ~/.ssh/config: line 14: Bad configuration option: proxyjump – K47 Nov 22 '19 at 22:01
  • and for second solution I get "unknown option -- J" – K47 Nov 22 '19 at 22:01
  • that means that your ssh is too old for the -J option. Can you tell what's your version with ssh -V? There are work-arounds. – A.B Nov 22 '19 at 22:49
  • Thanks it worked – K47 Nov 23 '19 at 8:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.