0

I have a problem that for 4 days no one has been able to solve. The problem might be on the datacenter side.

The problem is that one server can't talk to the other server. I even got technical support from two software providers involved to look at my server, and they can't find any misconfiguration either.

But both servers can be accessed via SSH from my home network. So how could I create a VPN tunnel from my home network (easily) so that it does this:

Server2 --> Home PC IP --> Server1

Or vice versa, so that my home IP from which SSH works find acts as a sort of proxy, to bypass any kind of NAT block or whatever could be blocking the connection?

The thing is that this second server is only temporary anyway, so doing something like this could solve my issue, even if the core issue isn't solved. I just need to get a huge amount of data directly from one server to the other.

How can I set up such a tunnel to bypass the problem?

4
  • If it is a one-time (or one-week/month) data transfer - it would be easier to just extract-tar whatever data needs to be transferred, copy it through any means and untar-load on the target server. VPN is more for a permanent solutions.
    – White Owl
    Jun 7, 2022 at 22:08
  • No, it would not, because it would take 2 weeks to do that, by which time the time is expired. My home internet connection has a 25mbps upload speed.
    – user7211
    Jun 7, 2022 at 22:22
  • Hoping for an answer to the question
    – user7211
    Jun 7, 2022 at 22:23
  • For educational purposes I am curious to see how it can be done, although this might not solve my current problem because I'm thinking it will still be throttled by my home internet connection since it would be passing through it. Although, it would eliminate a step by getting the data there directly rather than having to put it all on my home computer. So in that regard, it is still useful to do.
    – user7211
    Jun 8, 2022 at 17:49

1 Answer 1

1

You would need to open a SSH session from home to Server1, telling it to forward remote port 2222 to local port 2222:

ssh -Nt -g -4 -R *:2222:localhost:2222 server1.public.net # 1

This opens a listening port on Server1's port 2222. So, if you were to run "ssh 127.0.0.5 -p 2222" while on Server1, you would actually connect to whatever is running on your home machine on port 2222.

For now, nothing is running on that port.

You leave the first tunnel running, and run a different command against Server2:

ssh -Nt -g -4 -L 2222:localhost:22 server2.public.net # 2

This means that whoever connects to port 2222 on your home machine will now really be connected to local port 22 on server2.

Once these two processes are running, if you connect to Server1 you'll find a listening port 2222. Connect to that port while on Server1, and it will be Server2 that will answer.

So, to copy a file from "/tmp" in server1 to "/var/tmp" in server2 while on server1, you'd go

 scp -P 2222 /tmp/myfile [email protected]:/var/tmp

The connection will be pretty slow and could be optimized, but this way things are kept simpler.

The reason I'm using 127.0.0.5 instead of 127.0.0.5 is that your server is likely to already have a key for itself, under the heading "127.0.0.1", and SSH will complain if it detects a key mismatch (because on port 2222 the server answering is server2, not server1).

Upon the first connection, you'll receive a warning that server 127.0.0.5 on port 2222 is unknown and if you want to store its key in known hosts. Accept. That is the key of server2.

To be on the safe side, once you need it no longer, in your user's home directory you'll find a file ~/.ssh/known_hosts and, inside, several lines, the last of which will probably be

server2.whatever,127.0.0.5 ssh-rsa AAAAB3...

(the "127.0.0.5" is the important part that identifies the line you want). Delete that line. My systems never got confused between 127.0.0.1 and 127.0.0.5, but why risk.

However

...next time, one server can't talk to the other server is not a very helpful description. You know what it's going on, but you aren't communicating it clearly. Any of these might be happening:

  • server1 cannot ping server2 (firewall, routing, IP conflict)
  • server1 cannot connect w/ server2 (firewall, DNS problems)
  • server1 connects but hangs (cipher mismatch? use ssh -vvvv)
  • server1 connects but gets refused (bad key, user prohibited from logging in using plaintext password, sshrc misconfiguration...)
  • server1 connects but connection freezes very soon (MTU mismatch?)
  • and surely others I haven't experienced yet
16
  • There is another entire post and it's extremely long talking about the server communications issue if you're interested in that. unix.stackexchange.com/questions/704930/… I can't be blamed for not describing the other issue clearly, and this question is not about the computers not talking to each other, it's about opening a VPN tunnel, so I am staying on topic.
    – user7211
    Jun 8, 2022 at 17:28
  • I'm trying to understand what you're saying to do, I regret you didn't add command lines for it all. It sounds like it would work but I'm not sure how to do some of this. Firstly, how do you propose to do this: "telling it to forward remote port 2222 to local port 2222."? Second, which local IP? You put 127.0.0.5, but I'm pretty sure you meant my public facing IP from my home network? Third, in /etc/ssh/config on Server1, are you saying to put my home IP there? Or what IP are you identifying as 127.0.0.5? Can you make your answer more clear please?
    – user7211
    Jun 8, 2022 at 17:43
  • @user7211 the ssh/config change is probably unnecessary, I've rewritten some parts of the answer. "Local" IP is always in the 127.0.0.0/8 range, you do use your server's public IPs but in other places of the command line; I've replaced those with the ".public.net" domain to make this clearer.
    – LSerni
    Jun 8, 2022 at 18:08
  • is server1.public.net the hostname or IP? And I just use the actual 127.0.0.5 where you wrote that?
    – user7211
    Jun 8, 2022 at 18:54
  • It makes no difference if you use the hostname or IP, and yes, you can use 127.0.0.5 (or any lo address except for 127.0.0.1).
    – LSerni
    Jun 8, 2022 at 18:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .