VanDyke Software Forums

Go Back   VanDyke Software Forums > General
User Name
Password
Register FAQ Members List Calendar Search Today's Posts Mark Forums Read

Reply
 
Thread Tools Display Modes
  #1  
Old 07-13-2017, 09:02 AM
VanDyke82nev VanDyke82nev is offline
Registered User
 
Join Date: Jul 2017
Posts: 6
Proxy and Port Forwarding Devices

I have 30 sites behind 30 Firewalls/Gateways/ASAs.

For every site, I regularly SSH to a few boxes behind the firewalls. There are a few appliances also behind the firewalls with web-page-only information on them that would make my job much easier, but I can't access them with a browser because of the firewall.

I have been doing some reading and it looks like I can use SecureCRT to connect to the routers behind the firewalls, and then map some port on my local machine to forward through my SecureCRT connection to the router which then forwards to the appliance webpage, so I can pull up the webpage on my desktop machine.

I have read that the remote machine I'm connecting to as a proxy has to have 'remote port forwarding' enabled.
Do routers typically have this 'on' or 'off'?
I can log onto the routers. How can I tell if the router has it enabled?

No 'remote port forwarding' means, no proxy, right? Just being able to SSH to a device doesn't mean I can use it as a proxy?

What devices generally work/don't work?
Linux servers?
Windows servers?
routers?
web servers?
ASAs?
Gateways?
VMs?

thank you
Reply With Quote
  #2  
Old 07-13-2017, 09:57 AM
bgagnon bgagnon is offline
VanDyke Technical Support
 
Join Date: Oct 2008
Posts: 3,004
Hi VanDyke82nev,

Quote:
I have been doing some reading and it looks like I can use SecureCRT to connect to the routers behind the firewalls, and then map some port on my local machine to forward through my SecureCRT connection to the router which then forwards to the appliance webpage, so I can pull up the webpage on my desktop machine.

I have read that the remote machine I'm connecting to as a proxy has to have 'remote port forwarding' enabled.
What information have you been reading?

As far as the inquiries as to the capabilities/configuration of specific devices, hopefully other members of the community can help you with that.
__________________
Thanks,
--Brenda

VanDyke Software
Technical Support
support@vandyke.com
(505) 332-5730
Reply With Quote
  #3  
Old 07-13-2017, 03:29 PM
VanDyke82nev VanDyke82nev is offline
Registered User
 
Join Date: Jul 2017
Posts: 6
https://www.vandyke.com/support/tips/socksproxy.html
Reply With Quote
  #4  
Old 07-13-2017, 04:04 PM
VanDyke82nev VanDyke82nev is offline
Registered User
 
Join Date: Jul 2017
Posts: 6
(I am unable to edit the page above)

I've been reading pages like the link on the VanDyke site (above), and as well as pages elsewhere on SSH proxy, VPNs, etc. It looks like SecureCRT and the other clients do it as well, and even just the command line can set up SSH proxy.

But what's not exactly clear is what hosts work "for connecting to".

I can first connect to any of my hosts, and then ping or SSH to any of these machines that have the logs on the web pages, but the info on these pages is only available from a web page, not SSH.

I guess another option would be if CURL or WGET, or any other CLI browser exists on the SSH host machine, I could use that (maybe) but that's a far crappier solution than just relaying traffic from Firefox.
Reply With Quote
  #5  
Old 07-14-2017, 06:47 AM
bgagnon bgagnon is offline
VanDyke Technical Support
 
Join Date: Oct 2008
Posts: 3,004
Hi VanDyke82nev,

Quote:
I have read that the remote machine I'm connecting to as a proxy has to have 'remote port forwarding' enabled.
I am not seeing where the SOCKS proxy tip indicates remote port forwarding is needed. It talks about setting up a "regular" (ie: local, not remote) port forward with dynamic forwarding via SOCKS enabled.
__________________
Thanks,
--Brenda

VanDyke Software
Technical Support
support@vandyke.com
(505) 332-5730
Reply With Quote
  #6  
Old 07-14-2017, 01:42 PM
VanDyke82nev VanDyke82nev is offline
Registered User
 
Join Date: Jul 2017
Posts: 6
Hi Brenda,

https://www.vandyke.com/support/tips/socksproxy.html

I was going by this statement in the fourth paragraph.
>>Note that the term “gateway server” used here refers to any SSH server that supports port forwarding functionality.
Maybe I don't understand this topic well enough, but it's telling me that just because I can SSH to something does not mean it will forward my web traffic to another machine like I want. It has to support port forwarding.

Do I misunderstand?

I have permission to make config changes to these routers, but I have to get everything approved unless it's an outage problem, I doubt they will let me make any changes just to make my job easier.
Reply With Quote
  #7  
Old 07-14-2017, 02:17 PM
bgagnon bgagnon is offline
VanDyke Technical Support
 
Join Date: Oct 2008
Posts: 3,004
Hi VanDyke82nev,

That statement is referencing just port forwarding. Remote port forwarding is different.

Quote:
Maybe I don't understand this topic well enough, but it's telling me that just because I can SSH to something does not mean it will forward my web traffic to another machine like I want. It has to support port forwarding.

Do I misunderstand?
No, you don't misunderstand, you are correct. Port forwarding (and remote port forwarding) are permissions that can be granted by an SSH server, but just having the ability to SSH to that server does not necessarily mean you have port forwarding privileges.

I am not a router, switch, appliance, etc. expert by any means but those devices do not always have a full-featured SSH server that includes port forwarding functionality.
__________________
Thanks,
--Brenda

VanDyke Software
Technical Support
support@vandyke.com
(505) 332-5730
Reply With Quote
  #8  
Old 07-14-2017, 02:50 PM
VanDyke82nev VanDyke82nev is offline
Registered User
 
Join Date: Jul 2017
Posts: 6
So, ... hmm, how can I tell?

I've seen SSH proxy setup tutorials, and they all seem to go to either a Linux box or a router that's running DDWRT or Tomato.

I haven't seen anything that says "do this <xxx xxx xxx> to see if this host will work for you."

In my search I am seeing "reverse SSH tunnel" ... that's apparently another tool. I'm not sure what benefits it provides though.
Reply With Quote
  #9  
Old 07-17-2017, 07:15 AM
bgagnon bgagnon is offline
VanDyke Technical Support
 
Join Date: Oct 2008
Posts: 3,004
Hi VanDyke82nev,

You can try a port forward using dependent session functionality:

Changes in SecureCRT 7.1 (Beta 1) -- February 26, 2013
------------------------------------------------------

New features:

  • Added support for dependent sessions so that a connection can be made to a jump host or SSH gateway before the session is connected.
If the server does not support it, you should get a fairly obvious error in Trace Options output. Enable Trace Options from File menu before connecting the target/end device session.
  • Create a session to the jump host
  • Create a session to the target/end device
  • In the target/end device session, in the Connection/SSH2 category, from Firewall dropdown, choose Select Session..., then select the jump host session
  • Try to connect target/end device session
__________________
Thanks,
--Brenda

VanDyke Software
Technical Support
support@vandyke.com
(505) 332-5730

Last edited by bgagnon; 07-17-2017 at 12:01 PM. Reason: typo
Reply With Quote
  #10  
Old 07-17-2017, 08:02 AM
VanDyke82nev VanDyke82nev is offline
Registered User
 
Join Date: Jul 2017
Posts: 6
Hey Brenda,

That looks very promising. I hope to try that this afternoon.

Thank you.
Reply With Quote
Reply

Tags
port forwarding, proxy


Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump


All times are GMT -7. The time now is 11:49 PM.


© copyright 1995-2017 VanDyke Software, Inc.