Re: ssh tunneling

From: Vineet Kumar (debian-user_at_virtual.doorstop.net)
Date: 08/25/03

  • Next message: Alex Malinovich: "SMTP over SSH" 
    Date: Mon, 25 Aug 2003 14:13:58 -0700
To: debian-user@lists.debian.org

    * P. Kallakuri (praveen@unlserve.unl.edu) [030825 13:55]:
    > [...] when i ssh to the
    > gateway from localhost@some-internet-domain with the -L
    > 5903:vncserver:5903 option and forward from the gateway to the vncserver
    > using another ssh -L ..., i am not able to connect to the vncserver at
    > port 5903 on localhost. with a RealVNC viewer, i get an error like
    > "channel 2 or 4: administratively prohibited" and with TightVNC, i get
    > just a connection failure. [...]

    > why isn't the gateway/firewall allowing vnc ports to be forwarded to the
    > vncserver? or isn't that the problem? [...]

    No, that's not the problem. An ssh tunnel means that the traffic is all
    tunneled through the existing ssh connection. No, the gateway will not
    open up any new ports, and no, iptables won't need to allow any new
    ports.

    The gateway is listening on port 22, and vncserver is listening on port
    5903. That's all that matters.

    Say you're connected from your laptop to the gateway:

    laptop$ ssh gateway

    Then there's one connection: from the laptop to the gateway's port 22
    (ssh). You can use netstat to confirm this.

    Let's say you then open up a tunnel:

    ~C
    ssh> -L5903:vncserver:5903
    Forwarding port.

    There's still only one connection active. The only thing that has
    changed is that now your laptop is also listening on localhost:5903.
    When a connection is made to localhost:5903, the ssh tunnel kicks in,
    tunneling packets from the local vnc client to the vncserver on the
    other side of the gateway. No new connections are made to the gateway.
    All the traffic between the laptop and the gateway is just through the
    same, already open ssh connection.

    The vncserver will see a connection coming from the gateway. I don't
    know what sort of host-based access control the vnc server uses, but
    make sure it allows connections from the gateway's internal address.

    good times,
    Vineet 

    -- 
http://www.doorstop.net/
-- 
						--Nick Moffitt
A: No.
Q: Should I include quotations after my reply?



    -- 
To UNSUBSCRIBE, email to debian-user-request@lists.debian.org 
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
  • Next message: Alex Malinovich: "SMTP over SSH"

    Relevant Pages

    • Re: What is The SSH?
      ... Building and Using SSH Tunnels ... What is an SSH tunnel? ... how to use it to make a connection to a server. ... You will need a working SSH client and server installation to build and test ...
      (microsoft.public.windows.server.networking)
    • UPDATE: Re: Question regarding SSH via Lantronix SCS100
      ... to do SSH and to authenticate the SSH connection with a local ... unexpectedly closed connection'. ... CONSOLE or AUX port on the router, or does it matter, and what ...
      (comp.dcom.sys.cisco)
    • Re: SSH options re: NAT
      ... No, SSH is two-fold, a call to it on the client side results in a call ... port, meaning that any connections that come into that port are answered ... programming practice for daemons) Once the connection is established, ... don't want to execute a command on the remote side and you use -N. ...
      (comp.security.ssh)
    • SSH TCP forwarding: works with v1, not with v2 ssh
      ... that they're setting up the tunnels with no problem, ... I can get to the work ssh daemon: ... debug1: Connections to remote port 65002 forwarded to local address palimpsest:22 ... something answers (if I get "connection refused" there's no listener); ...
      (FreeBSD-Security)
    • Re: SSH TCP forwarding: works with v1, not with v2 ssh
      ... >that they're setting up the tunnels with no problem, ... >I can get to the work ssh daemon: ... > debug1: Entering interactive session. ... > Connection closed by foreign host. ...
      (FreeBSD-Security)