N.B. all of the below assumes that a "proper" vpn solution is not an option
The aim:To forward a port on network A to a machine on network B in such a way as to be accessible by all machines on network A, using the address that the machine on network B has.
The Caveat:It is not possible to make an ssh connection from Network A into Network B due to the the firewall setup, however the reverse is possible.
The solution:So ssh has this handy -R flag which allows you to forward a port from the remote host to the local network. Setting up a secondary ip address is easy enough using Linux's config tools (yast in my case), ifconfig or ip* The final part of the puzzle is to set up a route from all relevant machines on network A that direct it to the ssh gateway machine.
The problem:ssh, by default, does not allow you to specify the remote address to bind to (or rather, you can specify it but the packets will be silently dropped with no error message to indicate what you did wrong).
The Fix:edit /etc/ssh/sshd_config and add the line
GatewayPorts yesWhile you're there I recommend you also add
Why these two options are not enabled by default is beyond me.
The complete solution:
ok, so you have the following setup:
Network A: 192.168.0.0/24
Computer 1: 192.168.0.2, Windows
Computer 2: 192.168.0.3, *nix
Computer 3: 192.168.0.4, *nix, used as gateway
Router 1: internal: 192.168.0.1, external: 10.0.0.1, external port 22 forwarded to 192.168.0.4
Network B: 192.168.1.0/24
Computer 4: 192.168.1.2, Target (service port: 1234)
Computer 5: 192.168.1.3, *nix, used as gateway
Router 2: internal: 192.168.1.1, external: 10.0.0.2
On Computer 3:Edit (as root) /etc/ssh/sshd_config in your favourite editor and add the following options:
Use your systems config tools to add a second ip address for the network interface [in yast this is Network Devices->Network Settings->Edit->Add]
Set the ip address to be the same as the target computer (e.g. 192.168.1.2).
Don't worry about it being in a different ip range - we'll fix that later.
Create a new user and create an ssh private key for that user
On Computer 5:
Run the following command as a normal user (or get someone to run it for you): **
#ssh -v -R 192.168.1.2:1234:192.168.1.2:1234 firstname.lastname@example.org
On Computers 1 & 2:Configure a route to access the remote computer
* I only discovered ip existed today. It seems I am not the only one. Spread the word!
** See a separate blog post to follow about how to have this running all the time.