0

In order to connect to some of machines, what I currently do is:

  • Connect to VPN (using AnyConnect)
  • SSH to my jumpbox via VPN
  • For every single machine that I want to access using ssh, I have to map local port (e.g. port 12322 to port 22) to be forwarded via that jumpbox

The problem here is that IPs that I want to access to are not accessible directly from VPN, but they are accessible from jumpbox. I need basically to see what to install on my jumpbox, so that when I route 10.200.0.0/16 to that jumbpoxes IP, I can access this subnet via jumpbox from my external PC connected to VPN.

Is there an easier way? Somehow to just connect to jumpbox, and have all IPs that jumpbox can see accessible to me automatically (without having to do forwarding for every single IP i need)?

6
  • 1
    If you're connected by VPN, what's the point of tunneling over SSH? Can't you just connect directly to each destination? – Zac67 Oct 28 '20 at 11:38
  • no. it does not allow those IPs i need. bit it allows from that jumpbox. – Bojan Vukasovic Oct 28 '20 at 11:55
  • Then simply change the VPN access to include the final destinations. Note that networks and devices you don't fully control are off-topic here, see the help center. – Zac67 Oct 28 '20 at 13:39
  • tried that - but it does not work. – Bojan Vukasovic Oct 28 '20 at 13:42
  • Then you'll need to detail your network setup (devices, configs, diagram) and how the routing is done. Guessing is off-topic here as well. – Zac67 Oct 28 '20 at 18:06
2

VPN Routing

Yes, you have some options. You can route the IP space used for your machines (let's call those the SOHO LAN subnet) from the jump box across the VPN. If you do this with multiple sites, it becomes a hub-and-spokes VPN, where the sites can access each-other. If configuring this, keep in mind, each site needs to know about the IPs it should be routing across the VPN.

      vpn/jump box----172.17.0.0/30----remote laptop user
           |
           |
         soho
        router
           |
        /  |  \
  box1   box2   box3
     172.16.0.0/24

In the above diagram, the remote laptop user needs to route 172.16.0.0/24 to the VPN (a default route is okay, if you want all the laptop's traffic through VPN.)

The soho router also needs to know to route 172.17.0.0/30 (or whatever your VPN pool IPs are) to the VPN.

You can verify this by examining the route table of each VPN client (the soho router and the laptop) and checking with e.g. laptop> traceroute 172.16.0.2 goes over the VPN, not the ordinary Internet.

SSH ProxyJump

If SSH is the only application of interest, you can also use the ssh ProxyJump option (my blog post explaining same) in your ssh client configuration to ease your workflow without the need of a more complex network configuration.

I believe we used to work together. Hope all is well; and hope this helps with your project!

2
  • Thanks. Since my jumpbox is raspberryPI - which software is best to install there, so I do not have DHCP and not-needed stuff, but just to forward these routes that I direct to it? – Bojan Vukasovic Oct 29 '20 at 14:43
  • You need VPN software (freeswan, openvpn, etc.) and iptables. These should be available as OS packages for the Pi. You can find guides online demonstrating this. You will probably get some good answers if you re-post your question on Super User, too. The Network Engineering SE is focused on more commercial equipment and questions. superuser.com – Jeff Wheeler Oct 29 '20 at 15:00

Not the answer you're looking for? Browse other questions tagged or ask your own question.