Ssh tunnelling via intermediate host
title: 'Ssh tunnelling via intermediate host'
title: 'Ssh tunnelling via intermediate host' date: '2013-06-16T01:13:40-05:00' status: publish permalink: /ssh-tunnelling-via-intermediate-host author: admin excerpt: '' type: post id: 351 category: - Linux - SSH tag:  post_format: 
I recently needed to copy files using scp, while not able to copy directly to the target host. I had to use an intermediate firewall host. There is a few ways to get this done and most requires netcat (nc) on the intermediate host for copying.
Keep in mind using -t for just a ssh shell connection will work:
$ ssh -t firstname.lastname@example.org ssh email@example.com
If needing scp below is a way to get this done when netcat is not a possibility.
In a new terminal do this (command won't return a prompt and leave the terminal open):
$ ssh firstname.lastname@example.org -L 2000:10.24.0.200:22 -N
In a new terminal ssh as follow:
$ ssh -p 2000 admin@localhost
Scp as follow:
$ scp -P 2000 testfile admin@localhost:/tmp
Sftp also possible:
$ sftp -P 2000 admin@localhost
Update 1: Above will work fine but you can also consider the following to make things more transparent.
$ vi .ssh/config Host * ServerAliveCountMax 4 #Note default is 3 ServerAliveInterval 15 #Note default is 0 #snip host work-tunnel hostname backoffice.domain.com port 22 # SSH Server LocalForward localhost:2000 10.24.0.200:22 user rrosso # Aliases as follow host myhost.domain.com hostname localhost port 2000 user admin
Then run the tunnel connect first (use ssh -v while still troubleshooting):
$ ssh work-tunnel
Leave above terminal open to leave tunnel going. And now you can run commands in new terminals with syntax as if no tunnel required.
$ scp testfile myhost.domain.com:/tmp $ ssh myhost.domain.com
That should do it for a ssh shells.
Example for other ports:
Note you can do a lot of other ports also in similar fashion. Here is an example you could play with.
Host workTunnel Host ssh.domain.com Port 5001 # SMTP Server LocalForward localhost:2525 smtp.domain.com:25 # Corporate Wiki. Using IP address to show that you can. LocalForward localhost:8080 192.168.0.110:8080 # IMAP Mail Server LocalForward locahost:1430 imap.pretendco.com:143 # Subversion Server LocalForward locahost:2222 svn.pretendco.com:22 # NFS Server LocalForward locahost:2049 nfs.pretendco.com:2049 # SMB/CIFS Server LocalForward locahost:3020 smb.pretendco.com:3020 # SSH Server LocalForward locahost:2220 dev.pretendco.com:22 # VNC Server LocalForward locahost:5900 dev.pretendco.com:5900 ### Hostname aliases ### ### These allow you to mimic hostnames as they appear at work. ### Note that you don't need to use a FQDN; you can use a short name. Host smtp.domain.com HostName localhost Port 2525 Host wiki.domain.com HostName localhost Port 8080 Host imap.domain.com HostName localhost Port 1430 Host svn.domain.com HostName localhost Port 2222 Host nfs.domain.com HostName localhost Port 2049 Host smb.domain.com HostName localhost Port 3020 Host dev.domain.com HostName localhost Port 2220 Host vnc.domain.com HostName localhost Port 5900