2 ms·

Care to share more details?

by X4 13y ago

colanderman 13y ago
My use case is the (presumably common one) of being able to ssh out of a corporate network to a machine on the public Internet (e.g. your home machine), from which you want to tunnel back to the corporate network. On the server, set "PermitTunnel yes" in /etc/ssh/sshd_config, and run (as root): sysctl -w net.ipv4.ip_forward=1 ip tuntap add dev tun0 mode tun ip addr add $SERVER/32 peer $CLIENT/32 dev tun0 ip link set dev tun0 up arp -sD $CLIENT eth0 pub On the client, run (as root): ip tuntap add dev tun0 mode tun ip addr add $CLIENT/32 peer $SERVER/$PREFIX dev tun0 ip link set dev tun0 up The above settings need only be run once (unless you reboot the machines). Back on the server, as your normal user, run "ssh -w 0:0 user@$CLIENT" to establish the connection. The -N, -f, -oExitOnForwardFailure=yes, and -oServerAliveInterval=15 options may also be desired. $SERVER is the IP of the computer in the network you want to tunnel into. $CLIENT is the IP selected for the computer you want to tunnel from. Note: it is not the client's public IP! You should pick an unused one on the destination network. If you can't do this, then you can only tunnel to the server itself. $PREFIX is the size of the prefix of the network you want to forward (typically 16 or 24). If you only want to tunnel to the server itself, then $PREFIX should be 32, and you can skip the sysctl and arp commands on the server. If you have other tunX devices in use, adjust the tunnel device numbers accordingly (don't forget about changing ssh's -w argument too). This won't work if the client is also behind a NAT gateway or on a private network.
- X4 13y ago
  Thanks a lot for sharing this, highly appreciated! (Personally I would put it into a script, because I usually don't remember things like that.) Hmm, do you think this could be solved more elegantly on using a VM Containing a Cumulus Networks OS with a programmable Virtualized Network Stack? Product: http://cumulusnetworks.com/product/overview/ http://cumulusnetworks.com/product/overview/ Source: http://cumulusnetworks.com/product/open-approach/ http://cumulusnetworks.com/product/open-approach/
  - colanderman 13y ago
    Not a clue, I'm not really a networks guy! Though the setup in vanilla Linux is pretty straightforward I feel; not sure how much a VM would help with the use case I outlined above.

Care to share more details?

by X4 13y ago

Care to share more details?

My use case is the (presumably common one) of being able to ssh out of a corporate network to a machine on the public Internet (e.g. your home machine), from which you want to tunnel back to the corporate network. On the server, set "PermitTunnel yes" in /etc/ssh/sshd_config, and run (as root): sysctl -w net.ipv4.ip_forward=1 ip tuntap add dev tun0 mode tun ip addr add $SERVER/32 peer $CLIENT/32 dev tun0 ip link set dev tun0 up arp -sD $CLIENT eth0 pub On the client, run (as root): ip tuntap add dev tun0 mode tun ip addr add $CLIENT/32 peer $SERVER/$PREFIX dev tun0 ip link set dev tun0 up The above settings need only be run once (unless you reboot the machines). Back on the server, as your normal user, run "ssh -w 0:0 user@$CLIENT" to establish the connection. The -N, -f, -oExitOnForwardFailure=yes, and -oServerAliveInterval=15 options may also be desired. $SERVER is the IP of the computer in the network you want to tunnel into. $CLIENT is the IP selected for the computer you want to tunnel from. Note: it is not the client's public IP! You should pick an unused one on the destination network. If you can't do this, then you can only tunnel to the server itself. $PREFIX is the size of the prefix of the network you want to forward (typically 16 or 24). If you only want to tunnel to the server itself, then $PREFIX should be 32, and you can skip the sysctl and arp commands on the server. If you have other tunX devices in use, adjust the tunnel device numbers accordingly (don't forget about changing ssh's -w argument too). This won't work if the client is also behind a NAT gateway or on a private network.

X4 13y ago
Thanks a lot for sharing this, highly appreciated! (Personally I would put it into a script, because I usually don't remember things like that.) Hmm, do you think this could be solved more elegantly on using a VM Containing a Cumulus Networks OS with a programmable Virtualized Network Stack? Product: http://cumulusnetworks.com/product/overview/ http://cumulusnetworks.com/product/overview/ Source: http://cumulusnetworks.com/product/open-approach/ http://cumulusnetworks.com/product/open-approach/
- colanderman 13y ago
  Not a clue, I'm not really a networks guy! Though the setup in vanilla Linux is pretty straightforward I feel; not sure how much a VM would help with the use case I outlined above.