Tunneling over SSH

Advanced

Tunneling using the actual destination IP

Disclaimer: Don't use this on a production machine unless you fully grasp the mechnism.

Problem

Create a tunnel on a machine where an application is supposed to connect to a host that has been blocked by a firewall. Condition you can not change configuration and restart the application using the connection.

Solution

Asuming the target to connect to is 1.2.3.4 on port 56789 and we use 4.3.2.1 as the jump host. Before starting sshd has to accept remote forwards on all interfaces and IP addresses. To do that on the host running actual application the /etc/ssh/sshd_config file requires the AllowTcpForwarding and GatewayPorts to be set to yes

AllowTcpForwarding yes
GatewayPorts yes

HUPing the sshd process will enable the new configuration. With ssh this out of the way connection to the host in question.

ssh <JumpHost> -R <LocalPort>:<DestinationIP>:<DestinationPort>

ssh 4.3.2.1 -R 56789:1.2.3.4:56789

On the application host create an interface on the lo interface with this address with the traditional ifconfig it looks like below.

ifconfig lo:1 <DestinationIP> netmask 255.255.255.255 broadcast <DestinationIP> up

ifconfig lo:1 1.2.3.4 netmask 255.255.255.255 broadcast 1.2.3.4 up

With the ip command on linux this is how it looks like. Note: label lo:1 is optional.

ip addr add <DestiantionIP>/32 brd + label lo:1 dev lo

ip addr add 1.2.3.4/32 brd + label lo:1 dev lo

As soon as you bring the interface up you should see traffic going via the tunnel.