Connecting Through a Gateway Host
All along we’ve assumed that your outgoing connectivity is unlimited: that you can establish any outgoing TCP connection you desire. Even our discussions of firewalls have assumed that they restrict only incoming traffic. In more secure (or simply more regimented) environments, this might not be the case: in fact, you might not have direct IP connectivity at all to the outside world.
In the corporate world, companies commonly require all outgoing connections to pass through a proxy server or gateway host : a machine connected to both the company network and the outside. Although connected to both networks, a gateway host doesn’t act as a router, and the networks remain separated. Rather, it allows limited, application-level access between the two networks.
In this case study, we discuss issues of SSH in this environment:
Connecting transparently to external hosts using chained SSH commands
Making scp connections to these hosts
Running SSH-within-SSH by port forwarding
Running SSH-within-SSH by
These gateway techniques apply equally well when the situation is reversed: you’re on an external machine, and need to access various internal hosts through a single SSH gateway.
11.4.1 Making Transparent SSH Connections
Suppose your company has a gateway host, G, which is your only gateway to the Internet. You are logged into a client host, C, and want to reach a server host, S, outside the company network, as shown in Figure 11-11. We assume that ...