SSH Port forward connects to target instead of localhost

SSH Port forward connects to target instead of localhost

avatar
m.schouren

I'm doing a new evaluation of RDM. I want to tunnel SSH connections through an SSH tunnel to have a central break-out point within the network for management connections.

I set RDM up as follows to allow for a single 'gateway' connection to manage multiple remote machines.

Connection entry

  • Name: gw-linux (jump host)

  • Type: SSH tunnel

  • Host: 192.168.0.14

  • Port: Default

Outgoing tunnel settings:

  • Local address: 127.0.0.1

  • Local port: default

  • Remote host: $PARENT_HOST$

  • Remote port: 22

Next I set up an SSH Shell connection profile:

  • Name: targethost

  • Type: SSH Shell

  • Host: 192.168.0.19

  • Port: Default

VPN/SSH/Gateway

  • Open: Always connect

  • Type: SSH

  • Settings > Session > gw-linux (jump host)

  • Settings > Session > Use dynamic port: Enabled

  • Settings > Other > Override parent ($PARENT_HOST$): Enabled

Now when I try to connect it establishes the tunnel to the jump host:

Connecting to 192.168.0.14 port 22

Local port 127.0.0.1:41621 forwaring to 192.168.0.19:22

Then it attempts to connect to the target machine (which should by accessible through 127.0.0.1:41621):

Connecting to 192.168.0.19 port 41621

Network error: Connection refused

So RDM is connecting to the target host instead of the tunnel. If I configure More > Alternate Host > Prompt for selection and add 127.0.0.1 to the list it works, but this seems a bit of a workaround for a bug.

Can you confirm whether I'm doing it wrong or this is just a bug?

edit: this appears to overlap a bit with the following topic: https://forum.devolutions.net/topic26515-ssh-tunnel-vpn-entry--dynamic-port-usage.aspx

All Comments (2)

avatar
Maurice Côté

Hello,

I do not see in your structure where you have a parent, therefore why you are using PARENT_HOST.

There are two entries in play in a normal scenario, the Jump host, (in this case a SSH Tunnel) and a SSH Session.

The tunnel should take care of reaching the final destination, therefore the SSH Session connects to 127.0.0.1, it doesn't know anything about the remote host.

The full instructions can be found on How-To > How to Setup a SSH Tunnel

Best regards,

Maurice

avatar
m.schouren

I am using the parent host feature because I use 1 gateway entry for multiple SSH sessions. The instructions that you link are for a 1:1 setup (1 tunnel for 1 session, where I want a single tunnel entry for multiple actual sessions). This functionality is described in https://forum.devolutions.net/topic23592-multiple-rdp-hosts-via-single-ssh-tunnel.aspx :

In the next RDM beta version, we will have a few enhancements for our SSH portforward type, which is pretty much SSH tunneling. You will be able to put a variable in the "destination" field when adding a portforward (you can put multiple portforwards in one entry). In your case you would put the $PARENT_HOST$ variable.Then, in your RDP sessions, you would edit them and in the VPN/Tunnel/Gateway tab you would set it up to open your portforward session, making sure to check the new "override parent" checkbox. This will make your portforward consider the RDP connection as its parent, even if it is not. This will then resolve the parent variables like $PARENT_HOST$ using your RDP session as a base, thus taking its host.