1

Ok I have an odd but hopefully simple one. I have looked up SSH Tunneling already and I am familiar with the "ssh -r" command. But this situation is different.

Here's the setup. I have 1 gateway reverse-proxy/load-balancer/firewall server that accepts http requests and hands them off to 3 backend servers. Only the gateway has a publicly accessible IP address. All the backend servers are restricted to private IP's within the VPN. I do not have physical access to any of these servers (VPS Hosting). All the servers are Ubuntu, the proxy is pound.

What I need to be able to do is, use SSH to connect to any of the "boxes" for maintenance, updates, etc. through the gateway. As in calling from my home machine "ssh user@gateway -p [BACKEND PORT]" and have the gateway route that port number to the correct machine in a standard SSH fashion. How do I accomplish this?

CP510
  • 189
  • 1
  • 9

1 Answers1

3

If the pound server is a firewall, I'm assuming it will be running iptables, set up iptables to forward from external port X to internal port Y. Pound is designed to proxy http and https, port forwarding for non web traffic should be done by the appropriate software, which is not pound in this case.

Something like this might work

iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 222 -j DNAT --to 192.168.1.2:22
iptables -A FORWARD -p tcp -d 192.168.1.2 --dport 22 -j ACCEPT

iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 223 -j DNAT --to 192.168.1.3:22
iptables -A FORWARD -p tcp -d 192.168.1.3 --dport 22 -j ACCEPT

And so on, adjust to your situation, etc.

NickW
  • 10,263
  • 1
  • 20
  • 27