{"id":255690,"date":"2016-11-18T18:21:18","date_gmt":"2016-11-18T10:21:18","guid":{"rendered":"http:\/\/blog.zhenglei.net\/?p=255690"},"modified":"2016-11-18T18:21:18","modified_gmt":"2016-11-18T10:21:18","slug":"setup-reverse-tunnel-with-stunnel","status":"publish","type":"post","link":"https:\/\/blog.zhenglei.net\/?p=255690","title":{"rendered":"setup reverse tunnel with stunnel"},"content":{"rendered":"

Unlike ssh,\u00a0 stunnel dosen’t support the reverse tunnel by it’s self.<\/p>\n

With the help of tgcd ( TCP\/IP Gender Changer Daemon <\/a>), we are able to setup a reverse tunnel by chain the tgcd and stunnel:<\/p>\n

For example:<\/p>\n

We try to access the corp server from home,\u00a0 but due to the NAT firewall of the corp, only out going 80\/443 port are opened:<\/p>\n

client\u00a0 ==> tgcd LL node (home server)\u00a0 ==> tgcd CC node (corp agent) ==> corp server:<\/p>\n

Home Server:<\/strong><\/span><\/p>\n

Launching tgcd daemon in LL mode:
\n<\/span><\/p>\n

\u00a0\u00a0 tgcd -L -q 2222 -p 22222<\/em><\/p>\n

Listen on port 2222 for client access<\/p>\n

Listen on port 22222 for tgcd CC access<\/p>\n

 <\/p>\n

Launching stunnel in server mode:<\/span><\/strong><\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \/usr\/local\/bin\/stunnel \/etc\/stunnel\/stunnel_server.conf<\/em><\/p>\n

Listen on port 443 for incoming ssl connection<\/p>\n

Forward link with sni=tgcd to port 2222<\/p>\n

cat \/etc\/stunnel\/stunnel_server.conf<\/em><\/p>\n

[tls]<\/span>
\naccept = 0.0.0.0:443<\/span>
\nconnect = 127.0.0.1:1080<\/span><\/p>\n

[tgcd]<\/span>
\nsni = tls:tgcd<\/span>
\nconnect = 127.0.0.1:2222<\/span><\/p>\n

 <\/p>\n

Corp Agent Server:<\/strong><\/span><\/p>\n

Launching tgcd daemon in CC mode: <\/span><\/p>\n

tgcd -C -s 127.0.0.1:222 -c 127.0.0.227:2222<\/em><\/p>\n

Connect to tgcd LL node at: \u00a0 127.0.0.227:2222<\/em><\/p>\n

Connect to sshd server at: \u00a0 \u00a0 127.0.0.1:222<\/em><\/p>\n

Launching stunnel in client mode:<\/strong><\/span><\/p>\n

\/usr\/local\/bin\/stunnel \/etc\/stunnel\/stunnel_client.conf<\/p>\n

Listen on port 127.0.0.227:2222<\/em> from tgcd CC, and<\/p>\n

Access Home server via port 443 behind NAT and http proxy<\/p>\n

cat \/etc\/stunnel\/stunnel_client.conf<\/p>\n

 <\/p>\n

[ssh-tgcd-home]<\/span>
\naccept = 127.0.0.227:2222<\/span>
\nprotocolHost = home.serverip:443<\/span><\/p>\n

connect = http_proxy_ip:http_proxy_port<\/span>
\nprotocol = connect<\/span>
\nsni = tgcd<\/span><\/p>\n

 <\/p>\n

******************************************<\/p>\n

With such configuration, we can login into the corp server by means of:<\/p>\n

ssh -p 22222 \u00a0 home.server.ip<\/p>\n","protected":false},"excerpt":{"rendered":"

Unlike ssh,\u00a0 stunnel dosen’t suppo … \u7ee7\u7eed\u9605\u8bfb →<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6,4,18,226,9],"tags":[279,340,253],"class_list":["post-255690","post","type-post","status-publish","format-standard","hentry","category-internet","category-lfs","category-software-download","category-vpn","category-vps","tag-stunnel","tag-tgcd","tag-tunnel"],"_links":{"self":[{"href":"https:\/\/blog.zhenglei.net\/index.php?rest_route=\/wp\/v2\/posts\/255690","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.zhenglei.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.zhenglei.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.zhenglei.net\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.zhenglei.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=255690"}],"version-history":[{"count":1,"href":"https:\/\/blog.zhenglei.net\/index.php?rest_route=\/wp\/v2\/posts\/255690\/revisions"}],"predecessor-version":[{"id":255691,"href":"https:\/\/blog.zhenglei.net\/index.php?rest_route=\/wp\/v2\/posts\/255690\/revisions\/255691"}],"wp:attachment":[{"href":"https:\/\/blog.zhenglei.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=255690"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.zhenglei.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=255690"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.zhenglei.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=255690"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}