Linux – Error when SSH forwarding TCP to unix socket

Both of your problems don't sound to me like ssh tunnelling would be the best solution.

but still here are some of the ideas I came up with to achieve these goals:

Problem 1: using LocalTest as a reverse proxy for WebserviceServer

localtest:~ $ ssh -L *:10000:webserviceserver:443 localhost

make sure you allow "GatewayPorts" and "AllowTcpForwarding" in /etc/ssh/sshd_config on LocalTest and sshd is restarted.

Explanation

this opens up a connection from localtest to it self and at the same time creates a tunnel listening on port 10000 on all interfaces of localtest redirecting traffic to webserviceserver port 443

Problem 2: redirecting traffic to test workstations

with ssh this is actually the same as Problem 1

localtest:~ $ ssh -L *:8099:somestation1:5000 localhost

if you want to connect to another Test Workstation simply quit the first connection and use something like

localtest:~ $ ssh -L *:8099:somestation2:5002 localhost

Explanation

as it is basically the same solution as with problem 1 it has also the same explanation (just different hosts and ports :-) )

some thoughts

Keep in mind that both of the previous solutions open up the target systems (webserviceserver, somestationX) to anyone with access to LocalTest

And as I mentioned in the beginning I don't think ssh is the right tool to do this for a few reasons. Some of them being:

• with ssh you can only tunnel tcp traffic easily
• ssh is rarely the best solution for permanent tunnels
• Problem 1 sounds more like a case for a reverse proxy to me (or iptables as mentioned by others)
• Problem 2 definitely sounds like a case for iptables to me

I'd personally setup a simple script for the second problem which allows you to reset the iptables rules for each test system you want to use, something like

localtest:~ # reset_target somestation

such a script would have to delete an old redirect (to another test workstation) in iptables and then setup the new one. I'm not quite fluent with the iptables syntax at the moment and so I can't provide such a script right away but I'm sure somebody here could help you out with something like that if needed.

The reason ssh X forwarding wasn't working was because I have a /etc/ssh/sshrc config file.

The end of the sshd(8) man page states:

If ~/.ssh/rc exists, runs it; else if /etc/ssh/sshrc exists, runs it; otherwise runs xauth

So I add the following commands to /etc/ssh/sshrc (also from the sshd man page) on the server side:

if read proto cookie && [ -n "$DISPLAY" ]; then
        if [ `echo $DISPLAY | cut -c1-10` = 'localhost:' ]; then
                # X11UseLocalhost=yes
                echo add unix:`echo $DISPLAY |
                    cut -c11-` $proto $cookie
        else
                # X11UseLocalhost=no
                echo add $DISPLAY $proto $cookie
        fi | xauth -q -
fi

And it works!