Thread
:
SSH over VPN
View Single Post
mail_e36
2010-04-28 , 19:12
Posts: 393 | Thanked: 67 times | Joined on Feb 2010
#
1
Hello friends,
Let's assume I have established a
VPN tunnel using Vpnc from the N900 to a Cisco PIX
(the VPN endpoint). Once I am on the VPN, my N900 is assigned an internal IP address from the VPN pool. Using this IP address I have full access to other machines on my LAN (ping, telnet, ssh, etc.) All seems normal.
The problem comes in when
I want to use a Linux machine on my internal LAN as my 'gateway' to the internet using "ssh -D" from the VPN'd host
(the N900, in this case). I make the "ssh -D" connection from my VPN'd in N900 to the LAN linux machine, but any attempts to browse the web from the N900 fail (I have set up the N900's Firefox browser to listen using SOCKS on localhost (127.0.0.1) on a specific port). (For those familiar with Easy Debian, I have even tried the "Links" text-only browser inside the Easy Debian image, using the proper SOCKS configuration with no luck, so I know it's not a browser issue).
I have also tried this entire setup using the
Cisco native VPN client
on a WIndows XP machine with the
same results
(I can ping, ssh, telnet, etc, but 'ssh -D' doesn't do anything), so I know the problem is not the N900.
For background information, the "ssh -d" is supposed to specify a local ''dynamic'' application-level port forwarding. This works by allocating a socket to listen to port on the local side, bound to a specified bind address. Whenever a connection is made to this port, the connection is forwarded over the secure channel, and the application protocol is then used to determine where to connect to from the remote machine. In essence, I am trying to create a tunnel using SSH to my linux box so I can browse the web over the VPN.
Additionally, this entire
setup works perfectly when my N900 is sitting locally on the LAN
(bypassing the VPN altogether), so it seems my "ssh -D" command is correct. I am missing one crucial piece, but I am not sure what this piece is.
Considering the caliber of IT knowledgeable individuals on this forum,
I am hoping someone can share their ideas.
Thank you
Quote & Reply
|
mail_e36
View Public Profile
Send a private message to mail_e36
Find all posts by mail_e36