How to make Core Tunnel act like SSH Proxy

[g2unix (g2)]

In our email, you mentioned that Core Tunnel could act like SSH Proxy, just without the traffic routing. I must admit that I can’t see how to do that.

Before getting your advice, let me sing the praises of SSH Proxy for my situation. I don’t actually use the traffic routing as to use it in my situation would require dns resolution and then either regex or subnet matching. Where it is great is I can connect to multiple bastion hosts and use different port numbers. In my situation, establishing a connection require a OTP token, ssh key and password. SSH Proxy stores the password and key securely in keychain and SSH Proxy has the right understanding to prompt me for the token. Thus, I authenticate once, and now have a socks proxy on my local system. In my .ssh/config I then have hosts setup to ProxyCommand /usr/bin/nc -X 5 -x 127.0.0.1:3030 %h %p At least in this situation, I can set a default, and if that doesn’t work, I can just add -p 3031 for a different bastion. Thank you very much for that software.

Back to the question, is there a way to use core tunnel in a similar way to SSH Proxy?

[yang (Yang.Y)]

SSH Proxy creates a SOCKS proxy for you, and in Core Tunnel we name it Dynamic Port Forwarding. So in Core Tunnel, just create a tunnel and make sure there is a Dynamic Port Forwarding item, set the port number same to the “Listening Port” in SSH Proxy.

Please refer to Dynamic Port Forwarding section in this article:

What is port forwarding, and how it works

Introduction Port forwarding via SSH (SSH tunneling) creates a secure connection between a local computer and a remote machine through which services can be relayed. Because the connection is encrypted, SSH tunneling is useful for transmitting information that uses an unencrypted protocol, such as IMAP, VNC, or IRC. Types of Port Forwarding SSH’s port forwarding feature can smuggle various types of Internet traffic into or out of a network. This can be used to avoid network monitoring or sniff…

And if you have to work with ProxyCommand, there is a howto for it:

Connecting through a SOCKS / HTTPS proxy server

It is possible to make a tunnel over a SOCKS or HTTPS proxy, the option for this feature is ProxyCommand. This option is useful if you work behind a draconian firewall and can’t establishing ssh connection directly. Core Tunnel can call the command specified by ProxyCommand, expecting it to make the connection to the proxy server. After the connection is made, Core Tunnel uses the connection as the pipeline, and connects to the remote ssh host through the pipeline. netcat is one of ProxyComman…

Moreover, Core Tunnel can read your ssh_config:

Use system default `ssh_config` and `known_hosts` configuration

By default, Core Tunnel uses configuration files in its own container folder: # known_hosts ~/Library/Group Containers/E78WKS7W4U.io.coressh.ssh/.ssh/known_hosts # ssh_config ~/Library/Group Containers/E78WKS7W4U.io.coressh.ssh/.ssh/config This works very well in most of cases. But if you have a lengthy ~/.ssh/config or /etc/ssh/ssh_config, or have StrictHostKeyChecking set to yes and use ~/.ssh/known_hosts, /etc/ssh/ssh_known_hosts as the only source data trusted host keys, you may want to u…

It’s much powerful than SSH Proxy, except the lack of traffic routing.

[g2unix (g2)]

I will give it a try and see. Thank you for your advice and software.

[mikael.fransson]

So, will traffic routing be added to Core Tunnel at some point? That would make sense to me. I love SSH Proxy and use it all day every day but consolidating products sounds like a win win.

Thanks
Mikael

[yang (Yang.Y)]

No plan to add traffic routing to Core Tunnel for the moment