SSH tunnel with two hops

Question

I would like to build an ssh tunnel from my android device (call it A) on port MMM to a machine C on port NNN. HOWEVER, A and C are not directly connected. They are only connected through machine B (which is also running an ssh server). Finally, port NNN is only open locally on machine C (which is also running an ssh server).

So, with openssh in unix, I can use the command line of ssh or the ProxyCommand argument in .ssh/config to archive this:

Host C-tunnel
   HostName C
   Port 22
   Use username
   IdentityFile ~/.ssh/myidentityfileforC.pem
   ProxyCommand ssh -e none -i /.ssh/myidentityfileforB.pem username@B nc -w 120 %h %p 2> /dev/null

I can then set up a tunnel straight from my localhost to C:NNN (through the connection above).

Is there an app for android that supports similar? I tried connectbot and ssh autotunnel. The later got close, as I could set up one tunnel from A to B and then another from A to C (through the tunnelled A->B connection), but initiating the latter brought both of them down. Setting up just the first tunnel and then using connectbot allows me to connect via ssh to C, but I cannot set up a port forward directly to C:NNN.

Any suggestions? Is there a direct port of openssh I've missed?

Answer 1

I would like to share info that JuiceSSH has the feature you're trying to achieve with just one click. I'm talking about its feature "connect 'via' other SSH connections." Even local port forwarding from the second server thru the first ssh connection works too.

Answer 2

Outside of stackexchange, I also asked some colleagues. One suggestion they had did work. In particular, instead of using ssh autotunnel for the tunnels, I used connectbot to connect and create tunnels. They can be layered. The only downside is that I leave a shell open.

More specifically:

1. I use connectbot to connect to B (ssh, port 22) and then add a forwarding from a port 2222 on A to port 22 on C. I leave this shell open.
2. Then I make a new different connection to port 2222 on A (which opens a shell on C) and add port forwarding from port 2NNN to "localhost:NNN" (which is actually C:NNN).

Now I can connect to A:2NNN (my localhost, port 2NNN) and get to C:NNN as if it were local. I have to leave the shells open, but it works well enough.

Answer 3

This is based on shelton's comments but they confused me, so here's how to do a "-J" hop using ConnectBot, e.g. via something like serveo:

• Add a connection to the Hop host (e.g serveo). This is purely a "man in the middle", and will be used to forward to the real host. E.g: "[email protected]". You can turn off "Start shell session".

  • Save the serveo connection.
  • "Hold" the serveo connection in your list of hosts, and choose edit port forwards.
  • Add a new port forward. Type: "Local", source port: "2222", destination "alias:22". This opens localhost:2222 when this serveo connection is made, which will forward/hop your connection to the target host.

• Add a new host, matching the port forward. E.g "user@localhost:2222".

The normal usage workflow will now be:

• Connect to the serveo host. This will start the tunnel. Close (but don't disconnect), so the tunnel stays active.
• Connect to the second (localhost:2222) host. This will run through the tunnel to your remote host. Authenticate as normal and voila!