OSX下22以外埠上的SSH隧道
我正在嘗試從 WAN 訪問位於同一本地網路上的兩台不同機器的 VNC 伺服器。
由於我希望在 SSH 隧道中路由該流量,因此我正在使用
ssh admin@xxxxxx.net -N -L 15900:127.0.0.1:5900
and thenvnc://admin@127.0.0.1:15900
,第一台機器沒有問題。對於第二台機器,我將埠 2222 NAT 到路由器中這台機器 IP 的埠 22。NAT 還配置為將埠 5900 轉發到第一台機器的 IP,將埠 5901 轉發到第二台機器的 IP 的埠 5900。
我假設那
ssh -p2222 admin@xxxxxx.net -N -L 15901:127.0.0.1:5901
會vnc://admin@127.0.0.1:15901
起作用,但事實並非如此。我執行
ssh -p2222 admin@xxxxxx.net -N -L 15901:127.0.0.1:5901
命令的外殼輸出:通道 2:打開失敗:連接失敗:連接被拒絕
當我嘗試將 VNC 插入機器時。
我試過
ssh -v -p2222 admin@xxxxx.net -N -L 15901:127.0.0.1:5901
我得到了:
OpenSSH_6.2p2, OSSLShim 0.9.8r 8 Dec 2011 debug1: Reading configuration data /etc/ssh_config debug1: /etc/ssh_config line 20: Applying options for * debug1: /etc/ssh_config line 102: Applying options for * debug1: Connecting to xxxxx.net [xx.xx.xx.xx] port 2222. debug1: Connection established. debug1: identity file /Users/admin/.ssh/id_rsa type 1 debug1: identity file /Users/admin/.ssh/id_rsa-cert type -1 debug1: identity file /Users/admin/.ssh/id_dsa type -1 debug1: identity file /Users/admin/.ssh/id_dsa-cert type -1 debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_6.2 debug1: Remote protocol version 2.0, remote software version OpenSSH_5.2 debug1: match: OpenSSH_5.2 pat OpenSSH_5* debug1: SSH2_MSG_KEXINIT sent debug1: SSH2_MSG_KEXINIT received debug1: kex: server->client aes128-ctr hmac-md5 none debug1: kex: client->server aes128-ctr hmac-md5 none debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP debug1: SSH2_MSG_KEX_DH_GEX_INIT sent debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY debug1: Server host key: RSA xx:xx:xx:xx debug1: Host '[xxxxx.net]:2222' is known and matches the RSA host key. debug1: Found key in /Users/admin/.ssh/known_hosts:60 debug1: ssh_rsa_verify: signature correct debug1: SSH2_MSG_NEWKEYS sent debug1: expecting SSH2_MSG_NEWKEYS debug1: SSH2_MSG_NEWKEYS received debug1: Roaming not allowed by server debug1: SSH2_MSG_SERVICE_REQUEST sent debug1: SSH2_MSG_SERVICE_ACCEPT received debug1: Authentications that can continue: publickey,keyboard-interactive debug1: Next authentication method: public key debug1: Offering RSA public key: /Users/admin/.ssh/id_rsa debug1: Server accepts key: pkalg ssh-rsa blen 535 debug1: read PEM private key done: type RSA debug1: Authentication succeeded (public key). Authenticated to xxxxx.net ([xx.xx.xx.xx]:2222). debug1: Local connections to LOCALHOST:15901 forwarded to remote address 127.0.0.1:5901 debug1: Local forwarding listening on ::1 port 15901. debug1: channel 0: new [port listener] debug1: Local forwarding listening on 127.0.0.1 port 15901. debug1: channel 1: new [port listener] debug1: Requesting no-more-sessions@openssh.com debug1: Entering interactive session. debug1: Connection to port 15901 forwarding to 127.0.0.1 port 5901 requested. debug1: channel 2: new [direct-tcpip] channel 2: open failed: connect failed: Connection refused debug1: channel 2: free: direct-tcpip: listening port 15901 for 127.0.0.1 port 5901, connect from 127.0.0.1 port 51974, channels 3
有人知道嗎?
如果我正確理解了網路佈局,那麼您誤解了 SSH 隧道如何與 NAT 互動。基本上,一旦 NAT 路由器將您的 SSH 連接從 externalIP:2222 轉發到 privateIP1:22,NAT 就已經完成了它的工作並且不在等式中。
要獲得到第二台內部電腦的 VNC 連接,您需要通過隧道連接從本地電腦上的埠 15901,通過 SSH 連接到第一台內部電腦,然後從那裡到第二台內部電腦。你用
ssh -p2222 admin@xxxxxx.net -N -L 15901:privateIP2:5900
.“privateIP2:5900”部分是你所缺少的;您的版本告訴第一台電腦在埠 5901 上將連接轉發給自身(127.0.0.1);那裡沒有任何東西在聽,所以它被拒絕了。
您不希望 NAT 框將埠 5900 和 5901 轉發到任何東西——這會讓任何人 VNC 從任何地方進入這些電腦並完全忽略 SSH 隧道。