SSH端口转发

SSH隧道 - 本地转发

在上图中，公司业务服务器E放置在内网中，无公网接入，只能通过公司前置机C来访问，这种情况适用于SSH安全通道中的本地转发。具体应用场景如下：

场景一

访问公务业务服务器 192.168.100.2

建立本地与公司前置机C的通道，然后将业务服务器的ssh登陆端口映射到本地的6001端口上。配置如下

{
  "addr": [
    {
      "saddr": "23.112.22.2:22",
      "user": "root",
      "type": 1,
      "passwd": "test12345",
      "connect": "L",
      "remote": "192.168.100.2:22",
      "listen": "127.0.0.1:6001"
    }
  ]
}

然后访问本地的6001端口即可登陆公司业务服务器。

场景二

公司数据库服务器在192.168.100.3上，现在要在本地访问，数据库允许192.168.100.2机器访问。配置如下

{
  "addr": [
    {
      "saddr": "23.112.22.2:22",
      "user": "root",
      "type": 1,
      "passwd": "test12345",
      "connect": "L",
      "remote": "192.168.100.2:22",
      "listen": "127.0.0.1:6001",
      "son": [
        {
          "saddr": "127.0.0.1:6001",
          "user": "root",
          "type": 1,
          "passwd": "test12345",
          "connect": "L",
          "remote": "192.168.100.3:3306",
          "listen": "127.0.0.1:6002"
        }
      ]
    }
  ]
}

现在在本地直接访问 127.0.0.1:6002即是数据库服务。

场景三

公司的mongodb 服务器是192.168.100.4，mongodb只允许本机连接，ssh允许192.168.100.2访问，现在要在本地访问。

{
  "addr": [
    {
      "saddr": "23.112.22.2:22",
      "user": "root",
      "type": 1,
      "passwd": "test12345",
      "connect": "L",
      "remote": "192.168.100.2:22",
      "listen": "127.0.0.1:6001",
      "son": [
        {
          "saddr": "127.0.0.1:6001",
          "user": "root",
          "type": 1,
          "passwd": "test12345",
          "connect": "L",
          "remote": "192.168.100.4:22",
          "listen": "127.0.0.1:6003",
          "son": [
            {
              "saddr": "127.0.0.1:6003",
              "user": "root",
              "type": 1,
              "passwd": "test12345",
              "connect": "L",
              "remote": "127.0.0.1:27017",
              "listen": "127.0.0.1:6004"
            }
          ]
        }
      ]
    }
  ]
}

上面的配置例子，即可通过本地6004端口，访问云机的mongodb服务。

现在，将上面的配置进行一次融合，实现一个配置打通多个隧道。

{
  "addr": [
    {
      "saddr": "23.112.22.2:22",
      "user": "root",
      "type": 1,
      "passwd": "test12345",
      "connect": "L",
      "remote": "192.168.100.2:22",
      "listen": "127.0.0.1:6001",
      "son": [
        {
          "saddr": "127.0.0.1:6001",
          "user": "root",
          "type": 1,
          "passwd": "test12345",
          "connect": "L",
          "remote": "192.168.100.3:3306",
          "listen": "127.0.0.1:6002"
        },
        {
          "saddr": "127.0.0.1:6001",
          "user": "root",
          "type": 1,
          "passwd": "test12345",
          "connect": "L",
          "remote": "192.168.100.4:22",
          "listen": "127.0.0.1:6003",
          "son": [
            {
              "saddr": "127.0.0.1:6003",
              "user": "root",
              "type": 1,
              "passwd": "test12345",
              "connect": "L",
              "remote": "127.0.0.1:27017",
              "listen": "127.0.0.1:6004"
            }
          ]
        }
      ]
    }
  ]
}

SSH隧道 - 远程转发

在公司上班，发现家里的应用出现了问题，但家庭网络是NAT网络，无公网IP，可以通过建立A与D之间的安全通道，来实现访问家庭网。配置如下：

{
  "addr": [
    {
      "saddr": "123.123.123.111:22",
      "user": "root",
      "type": 1,
      "passwd": "test12345",
      "connect": "R",
      "remote": "127.0.0.1:20222",
      "listen": "127.0.0.1:22"
    }
  ]
}

在家的服务器上运行这个程序，即可建立固定服务器D和家的安全隧道。然后人在外地也可以通过登陆D服务器的20222来访问家的22端口。

SSH隧道 - 动态转发

公司不允许访问 F点的服务器，然而D服务器可以访问F点的服务器，可以通过D服务器建立动态端口转发通道来访问F服务器。配置如下：

{
  "addr":[
    {
      "saddr": "123.123.123.111:22",
      "user": "root",
      "type": 1,
      "passwd": "test12345",
      "connect": "D",
      "listen": "127.0.0.1:12345"
    }
  ]
}

本机的所有流量从12345端口出入，即可通过123.123.123.111代理访问。