Providing an Internal Network Service on the Public Internet

This uses SSH tunneling, which I discussed in early 2005 on this blog. If you have one machine that acts as a gateway and others behind it, it is possible to get behavior like port forwarding on broadband routers using the following:

(run this on gateway machine)

ssh user@localhost -g -L interal_port:internal_ip:external_port -N -f

This is standard tunneling but with the -g option, which allows connections on the local machine from *any* host. Normally when you tunnel using the -L option, you can connect to localhost and access a service on another machine. No one else but you can use these forwarded ports however. -g opens up the tunnel.

You may need to allow tcp forwarding in etc/ssh/sshd_config. Add the following line:

AllowTcpForwarding yes

Also, you will need to have the external port open on the gateway machine's firewall. This is very OS specific. On Redhat Enterprise Linux, run the following in X:

system-config-securitylevel

And add the port as an 'other port' using tcp or udp.

Providing a local network service to a remote machine

ssh -L provides a remote service locally.

For example, if we wish to connect to www.google.com (port 80) but want it to appear as if the server is on the local machine you could do
ssh mylogin@localhost -L 80:google.com:80 -N -f
-N does no execute a remote command (the shell wont come up when you connect)
-f run as background process (drops you back to your local shell after connecting)

ssh -R brings a local service to another machine (an outside machine in this case)

This is the reverse of -L. After doing the above, we could connect like this to a remote machine running ssh and it could go to localhost:80 and see google.

ssh myremotemachine -l username -R 80:localhost:80 -N -f

Now a user of myremotemachine can connect to localhost in a webbrowser and see google. This is fairly pointless except if you have two networks in different places and want to have machines behind the gateways communicate with each other. It's sort of like vpn, but not. More specific.


As another example, we are behind a proxy and a machine on the local network is running a license server.

On the gateway machine on this network, we start ssh -L. (actually it does not have to be the gateway machine... you can use -o 'commands here' to go through a proxy server on the gateway machine if it exists).

ssh localhost -l username -L 5461:server.com:5461 -N -f

Now to provide this service outside is

ssh remotemachine -l username -R 5461:localhost:5461 -N -f

in /etc/ssh/sshd_config AllowTCPForwarding must be yes
After changing this you must do /etc/init.d/sshd restart

SSH tunneling under Solaris 9

After setting up an SSH tunnel under Solaris 9 using ssh -L, get the following errors when connecting using telnet:

channel_open_failure: 2: reason 1: open failed
channel_open_failure: 3: reason 1: open failed

The solution is to enable tcp forwarding in /etc/ssh/sshd_config:

AllowTcpForwarding yes

In RedHat this is probably set to yes already.