On 2017-02-20 16:16, Carlos E. R. wrote:

On 2017-02-20 16:12, James Knott wrote:

...

On 02/20/2017 10:04 AM, Carlos E. R. wrote:

...

Even the right string for a search in google or elsewhere is nice ;-)

Did you try "ssh tunnel"? That produces several hits.

Thanks, no :-)

Starting reading now.

According to the first hit, http://www.revsys.com/writings/quicktips/ssh-tunnel.html it is very simple: «ssh -f user@personal-server.com -L 2000:personal-server.com:25 -N» «The -f tells ssh to go into the background just before it executes the command. This is followed by the username and server you are logging into. The -L 2000:personal-server.com:25 is in the form of -L local-port:host:remote-port. Finally the -N instructs OpenSSH to not execute a command on the remote system.» «This essentially forwards the local port 2000 to port 25 on personal-server.com over, with nice benefit of being encrypted. I then simply point my E-mail client to use localhost:2000 as the SMTP server and we're off to the races.» So I have tried: ssh -X cer@home.server -L 60000:home.server:80 -N Then I point my local firefox to http://127.0.0.1/:60000 and I get the response: "Unable to connect" I then thought that it might be: ssh -X cer@home.server -L 60000:127.0.0.1:80 -N but I get the same error. I must be doing it wrong... :-? Also (as (client) user and root): ssh -X cer@home.server -L 127.1.0.1:60000:127.0.0.1:80 -N then browsed to: http://127.1.0.1/:60000 So it is not that simple as that doc says :-? -- Cheers / Saludos, Carlos E. R. (from 42.2 x86_64 "Malachite" (Minas Tirith))

On 2017-02-20 16:17, Anton Aylward wrote:

On 02/20/2017 10:04 AM, Carlos E. R. wrote:

...

Where can I read about this? A nice document for dummies would be nice, I'm not asking for someone to start typing the full explanation :-)

Even the right string for a search in google or elsewhere is nice ;-)

I have two pertinent books on my nearby shelf. Both by O'Reilly.

"SSH, the Secure Shell" has a section on setting up a SSH tunnel.

"Virtual Private networks" has a more general section on SSH and also such techniques as SSH+PPP, as well as VPNs though firewalls, layer 2 VPNs, as well as the basic principles of identification, authentication and encryption. It touches on but doesn't drill down on IPSec and S/WAN.

Both have pages of resource lists.

Apparently, the thing is very easy, according to two pages I read: http://www.revsys.com/writings/quicktips/ssh-tunnel.html http://blog.trackets.com/2014/05/17/ssh-tunnel-local-and-remote-port-forward... «Another good example is if you need to access a port on your server which can only be accessed from localhost and not remotely.» «An example here is when you need to connect to a database console, which only allows local connection for security reasons. Let’s say you’re running PostgreSQL on your server, which by default listens on the port 5432.» «$ ssh -L 9000:localhost:5432 user@example.com» «The part that changed here is the localhost:5432, which says to forward connections from your local port 9000 to localhost:5432 on your server. Now we can simply connect to our database.» «$ psql -h localhost -p 9000» I understand that explanation, it is very simple! Plain as water! But it doesn't work for me... I do: ssh -X cer@home.server -L 60000:localhost:80 -N or ssh -L 60000:localhost:80 -N cer@home.server which connects, of course (no error messages); then I browse on the client to: http://localhost/:60000 and get: +++------------------------ Unable to connect Firefox can’t establish a connection to the server at localhost. The site could be temporarily unavailable or too busy. Try again in a few moments. If you are unable to load any pages, check your computer’s network connection. If your computer or network is protected by a firewall or proxy, make sure that Firefox is permitted to access the Web. ------------------------++- -- Cheers / Saludos, Carlos E. R. (from 42.2 x86_64 "Malachite" (Minas Tirith))

On 2017-02-20 17:43, Andrei Borzenkov wrote:

20.02.2017 19:30, Carlos E. R. пишет:

...

http://localhost/:60000

and get:

+++------------------------ Unable to connect

URL is wrong; slash is misplaced. Where have you got it from?

http://localhost:60000/

Bingo! Thanks. I didn't see the obvious... Where did I got it from? My memory, where else? X'-) Curious. I get access denied on some of my pages. Apparently localhost translates to ::1 and apache or apparmour dislikes it. I have to use -L 60000:192.168.1.16:80 instead: works fine. :-)) -- Cheers / Saludos, Carlos E. R. (from 42.2 x86_64 "Malachite" (Minas Tirith))

On 2017-02-20 16:41, Greg Freemyer wrote:

On Mon, Feb 20, 2017 at 10:04 AM, Carlos E. R. <> wrote:

If the destination server is protected by firewall that blocks SSH connections, you will want a reverse tunnel.

No, not the case. In fact, ssh is the only port I opened on the home server.

I use reverse tunnels to connect to the machines in my lab.

The basic concept is I have server in the cloud (a VM instance I pay for). The firewalls related to my cloud VM are on my server, so I have 100% control of the open ports.

At my office, my ISP blocks a lot of ports.

My lab machines use autossh to maintain an outbound connection to the VM.

The VM in turn opens ports and forwards all new connections back to my servers in my lab.

I have 5 PCs in my lab that I can access that way. For each one I have a dedicated, non-standard, port on the VM server that allows access to my machines.

It's a little complicated to setup, especially if the lab machines are Windows based.

Interesting... but I don't think I need that complication :-)

I wrote a tutorial on how to do it. Even if I'm the only user of the tutorial, it is good to have.

https://lizards.opensuse.org/2015/04/20/using-opensuse-as-a-reverse-tunnel-s...

Thanks, I'll have a look. -- Cheers / Saludos, Carlos E. R. (from 42.2 x86_64 "Malachite" (Minas Tirith))

21.02.2017 05:10, Carlos E. R. пишет:

ssh -L 60000:localhost:80 -N cer@home.server

browse to:

http://localhost:60000

And I'm guessing that it can do more than what I use it for. What if I specify a local IP, no port?

It is invalid syntax. You spend more time asking "what if" than actually trying it.