0

What I'd like to achieve is almost exactly what is described in this article : https://peter-jp-xie.medium.com/use-double-ssh-tunnels-instead-of-vpn-to-access-private-network-f0dee50d82e3 and represented in this image : enter image description here

Except I would like the local tunnel on the "Home PC" of this diagram (listening on port 9000) to act as if it was a Dynamic port forward (usually opened with the -D option of SSH), so basically a SOCKS proxy.
But I want this SOCKS proxy to not redirect connections via the Public server, but route it up to the Private PC, which would essentially become the real "pivot" point, redirecting the connections to their real IP destinations.

In other words, it would be like using dynamic port forwarding on "Home PC" by connecting directly to "Private PC" via ssh, instead of connecting to Public Server. Except Private PC and Home PC are both behind NAT, and can only make outgoing connections, so Public Server needs to act as the "rendez-vous" point.

I am failing to see how I can combine SSH options to achieve this, or if it's even possible to achieve with SSH. If SSH isn't an option, would you have any other technology to suggest ? I thought about maybe using Wireguard, but I'm not sure if the Private PC can access the Public Server via UDP - whish is used by Wireguard.

EDIT: I think I thought of a solution, that would require a SSH server on the "Private PC" : first create a double tunnel exactly like shown on the first image, except it would point to localhost:22 on the Private PC. Then, on home PC, SSH to the Private PC by using the local port forward created earlier (effectively allowing Home PC to connect to Private PC) and use the -D flag to open a dynamic port forward via this tunnel. So... a SSH tunnel going through another "double SSH tunnel". I didn't try it but it should work I think.

Is there any other more beautiful and simpler way to achieve this ?

1
  • As you have figured out there must be an SSH server inside the "Private" network. The server can run on either PrivatePC or PrivateServer. Then you have 2 SSH tunnels from HomePC: First to PublicServer establishing the path into the PrivateNetwork to the ssh server (localhost:22 or 10.0.0.12:22 or some other existing ssh server), and second with the -D option to the SSH server inside PrivateNetwork. Commented Jul 22, 2022 at 14:16

1 Answer 1

2

You already described a solution in your edit:

you have to connect with a ssh -D ... from Home PC to Private PC (or maybe Private Server, if they are on the same network).

An option could be from Private PC:

ssh -R9000:localhost:22 PublicServer 

then on Home PC:

ssh -J PublicServer -p9000 localhost -D1080 

and voilà, your port tcp/1080 on Home PC is now a socks proxy exiting via PrivatePC's interface.

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.