ssh tunneling: ssh_exchange_identification

[DenOuwenBelg]

Hi all,

I have a problem setting up an ssh tunnel. Can you tell me what I'm doing wrong?

The situation is like this: There are 3 computers, let's call them home, remoteFirewall and remoteTarget.

I want to set up tunnels so that when I execute: "ssh localhost" on home,
I actually connect to remoteTarget.

I can ssh to remoteFirewall from home, and once I'm on remoteFirewall, I can do ssh remoteTarget. That works.

So I tried this to create a tunnel:
on home -> ssh -L22:remoteFirewall:9999 remoteFirewall
on remoteFirewall -> ssh -L9999:remoteTarget:22 remoteTarget

So far so good.

but when I try this on home:
ssh localhost
I get the following error message:

ssh_exchange_identification: Connection closed by remote host

The next thing I tried was this:
ssh -L22:remoteFirewall:22 remoteFirewall
and than
ssh localhost

As far as I understand ssh, doing this "ssh localhost" and "ssh remoteFirewall" should be equivalent, right?

Does any one have an idea of what I'm doing wrong?

Thanks in advance!

YD

[nielchiano]

I'm not sure if it's supposed to work that way, but you are tunneling to much.

just try this:

ssh into remoteFirewall and request a tunnel: -L22:remoteTarger:22
then connect ssh localhost

this will make an ssh connection from home to firewall, and one from home to remoteTarget (in 2 hops, home --> remoteFirewall is double SSh'd, remoteFirewall is only once SSH'd)

[DenOuwenBelg]

Hi Nielchiano,

I'm only root on home, so I can't forward privileged ports on the other machines.

But as I added in my previous post, I've tried to forward port 22 on home to port 22 on remoteFirewall, and that didn't work either.
It gave me the same error message.

Any other ideas?

[nielchiano]

i know the situation... but it works with me... maybe not on the priv-ports...

the thing that works with me is:
connect from A to B, ask port forward -L22222:C:22222
then connect from A to A:22222 and get response from C

IMHO you should be allowed to forward TO privileged ports, so -L22:remoteTarget:22 should (IMHO) work, since you request a privileged port LOCALY (where you are root) and connect to somewhere remote.

you can also try -L22222:remoteTarget:22
and then do ssh -p 22222 localhost