0

I saw here a way to do two ssh hops

ssh -L 9998:host2:22 -N host1
ssh -L 9999:localhost:1234 -N -p 9998 localhost

I think I understand what one line does, but not how they work together. Can you keep on doing this to have tunnels within tunnels for many hops? Would it be like this?

ssh -L 9997:host3:22 -N host2
ssh -L 9998:host2:22 -N host1
ssh -L 9999:localhost:1234 -N -p 9998 localhost

Community
  • 1
Josh
  • 3
  • 1

1 Answers1

4

It depends on what you are trying to forward via SSH. AKA what you are trying to do.

The -L lport:host:hport syntax makes it so that if you connect to lport on your starting host you will connect to hport on host.

So say you are on hostA. and you want to get to the http (port 80) on hostD that isn't reachable except by hostC that is only reachable by hostB and that is reachable by your starting hostA.

You can run (from hostA):

ssh -L 8080:localhost:8081 hostB

then on that hostB login run:

ssh -L 8081:localhost:8082 hostC

then on that hostC login run:

ssh -L 8082:localhost:80 hostD

You can then (on hostA) access localhost:8080 and connect to hostD's port 80.

Note: you can use the same 8080 on all as you are only using that port once per machine. I just upped the port numbers each connection to better show the correlations between the ports.

The other thing to keep in mind is the host (between the two :'s) is in the context of the machine you are ssh'ing into. so if hostC had direct access to hostD's port 80, you could have instead done the following:

You can run (from hostA):

ssh -L 8080:localhost:8081 hostB

then on that hostB login run:

ssh -L 8081:hostD:80 hostC

Steve
  • 56
  • 2
  • Did you mean "if hostB had direct access to hostD's port 80?" Because I thought we already said hostD isn't reachable except by hostC. – Josh Sep 17 '13 at 12:41
  • Ah, I figured it out. We can't access port 80 on hostD. So with this method does the content stay encrypted on each hop point? Or does hostB decrypt it and reencrypt? Ideally it would stay encrypted and hostB and hostC would just serve as forwarders that could repeat or encrypt with an additional layer. – Josh Sep 17 '13 at 21:26
  • @Steve can we do similarly with the ssh_config file Proxy command? – Andrew Wolfe Dec 03 '15 at 16:42