SSH, The Secure Shell: The Definitive Guide, 2nd Edition

Connecting Through a Gateway Host

All along we’ve assumed that your outgoing connectivity is unlimited: that you can establish any outgoing TCP connection you desire. Even our discussions of firewalls have assumed that they restrict only incoming traffic. In more secure (or simply more regimented) environments, this might not be the case: in fact, you might not have direct IP connectivity at all to the outside world.

In the corporate world, companies commonly require all outgoing connections to pass through a proxy server or gateway host : a machine connected to both the company network and the outside. Although connected to both networks, a gateway host doesn’t act as a router, and the networks remain separated. Rather, it allows limited, application-level access between the two networks.

In this case study, we discuss issues of SSH in this environment:

• Connecting transparently to external hosts using chained SSH commands

• Making scp connections to these hosts

• Running SSH-within-SSH by port forwarding

• Running SSH-within-SSH by ProxyCommand

Tip

These gateway techniques apply equally well when the situation is reversed: you’re on an external machine, and need to access various internal hosts through a single SSH gateway.

11.4.1 Making Transparent SSH Connections

Suppose your company has a gateway host, G, which is your only gateway to the Internet. You are logged into a client host, C, and want to reach a server host, S, outside the company network, as shown in Figure 11-11. We assume that ...