OSX下22以外埠上的SSH隧道

我正在嘗試從 WAN 訪問位於同一本地網路上的兩台不同機器的 VNC 伺服器。

由於我希望在 SSH 隧道中路由該流量，因此我正在使用 ssh admin@xxxxxx.net -N -L 15900:127.0.0.1:5900and then vnc://admin@127.0.0.1:15900，第一台機器沒有問題。

對於第二台機器，我將埠 2222 NAT 到路由器中這台機器 IP 的埠 22。NAT 還配置為將埠 5900 轉發到第一台機器的 IP，將埠 5901 轉發到第二台機器的 IP 的埠 5900。

我假設那 ssh -p2222 admin@xxxxxx.net -N -L 15901:127.0.0.1:5901會 vnc://admin@127.0.0.1:15901起作用，但事實並非如此。

我執行ssh -p2222 admin@xxxxxx.net -N -L 15901:127.0.0.1:5901命令的外殼輸出：

通道 2：打開失敗：連接失敗：連接被拒絕

當我嘗試將 VNC 插入機器時。

我試過ssh -v -p2222 admin@xxxxx.net -N -L 15901:127.0.0.1:5901

我得到了：

OpenSSH_6.2p2, OSSLShim 0.9.8r 8 Dec 2011
debug1: Reading configuration data /etc/ssh_config  
debug1: /etc/ssh_config line 20: Applying options for *  
debug1: /etc/ssh_config line 102: Applying options for *  
debug1: Connecting to xxxxx.net [xx.xx.xx.xx] port 2222.  
debug1: Connection established.  
debug1: identity file /Users/admin/.ssh/id_rsa type 1  
debug1: identity file /Users/admin/.ssh/id_rsa-cert type -1  
debug1: identity file /Users/admin/.ssh/id_dsa type -1  
debug1: identity file /Users/admin/.ssh/id_dsa-cert type -1  
debug1: Enabling compatibility mode for protocol 2.0  
debug1: Local version string SSH-2.0-OpenSSH_6.2  
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.2  
debug1: match: OpenSSH_5.2 pat OpenSSH_5*  
debug1: SSH2_MSG_KEXINIT sent  
debug1: SSH2_MSG_KEXINIT received  
debug1: kex: server->client aes128-ctr hmac-md5 none  
debug1: kex: client->server aes128-ctr hmac-md5 none  
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent  
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP  
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent  
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY  
debug1: Server host key: RSA xx:xx:xx:xx  
debug1: Host '[xxxxx.net]:2222' is known and matches the RSA host key.  
debug1: Found key in /Users/admin/.ssh/known_hosts:60  
debug1: ssh_rsa_verify: signature correct  
debug1: SSH2_MSG_NEWKEYS sent  
debug1: expecting SSH2_MSG_NEWKEYS  
debug1: SSH2_MSG_NEWKEYS received  
debug1: Roaming not allowed by server  
debug1: SSH2_MSG_SERVICE_REQUEST sent  
debug1: SSH2_MSG_SERVICE_ACCEPT received  
debug1: Authentications that can continue: publickey,keyboard-interactive  
debug1: Next authentication method: public key  
debug1: Offering RSA public key: /Users/admin/.ssh/id_rsa  
debug1: Server accepts key: pkalg ssh-rsa blen 535  
debug1: read PEM private key done: type RSA  
debug1: Authentication succeeded (public key).  
Authenticated to xxxxx.net ([xx.xx.xx.xx]:2222).  
debug1: Local connections to LOCALHOST:15901 forwarded to remote address 127.0.0.1:5901  
debug1: Local forwarding listening on ::1 port 15901.  
debug1: channel 0: new [port listener]  
debug1: Local forwarding listening on 127.0.0.1 port 15901.  
debug1: channel 1: new [port listener]  
debug1: Requesting no-more-sessions@openssh.com  
debug1: Entering interactive session.  
debug1: Connection to port 15901 forwarding to 127.0.0.1 port 5901 requested.  
debug1: channel 2: new [direct-tcpip]  
channel 2: open failed: connect failed: Connection refused  
debug1: channel 2: free: direct-tcpip: listening port 15901 for 127.0.0.1 port 5901, connect from 127.0.0.1 port 51974, channels 3  

有人知道嗎？

如果我正確理解了網路佈局，那麼您誤解了 SSH 隧道如何與 NAT 互動。基本上，一旦 NAT 路由器將您的 SSH 連接從 externalIP:2222 轉發到 privateIP1:22，NAT 就已經完成了它的工作並且不在等式中。

要獲得到第二台內部電腦的 VNC 連接，您需要通過隧道連接從本地電腦上的埠 15901，通過 SSH 連接到第一台內部電腦，然後從那裡到第二台內部電腦。你用ssh -p2222 admin@xxxxxx.net -N -L 15901:privateIP2:5900.

“privateIP2:5900”部分是你所缺少的；您的版本告訴第一台電腦在埠 5901 上將連接轉發給自身（127.0.0.1）；那裡沒有任何東西在聽，所以它被拒絕了。

您不希望 NAT 框將埠 5900 和 5901 轉發到任何東西——這會讓任何人 VNC 從任何地方進入這些電腦並完全忽略 SSH 隧道。

引用自：https://serverfault.com/questions/733969