Connection to a Server with Reverse Tunnel via Tunnel-type Listener

This scenario describes the case when:

  • The listener is configured in Tunnel mode.

  • The target server uses an SSH reverse tunnel (the Use SSH tunnel option) through a jump host (an intermediary server) that has access to both Fudo Enterprise and the target server.

User Configuration

  1. Go to User Management > Users and click Add user.

  2. Enter a name (e.g., Tunnel_User) and click Save.

  3. Select the user authentication method:

    • Choose e.g. Static password from the Add authentication method dropdown.

    • Enter the password for the created user (e.g., TestPassw0rd).

    • Click Save to close the dialog.

  4. Click Save and exit.

Creating a Listener

  1. From the left menu, select Session Management > Listeners and click Add listener.

  2. Enter a unique name (e.g., SSH_Tunnel).

  3. Go to the Settings tab and press SSH in the Protocol field.

  4. In the Connection mode section, select Tunnel.

  5. From the Local address list, select an IP address and port for the listener (np: 10.31.135.179 i 3455).

  6. Click Save.

Note

The Keys field displays generated SSH, TLS, and Standard RDP Security keys as well as a TLS certificate required for proper operation of a “Tunnel”-type listener.

RDP Server Configuration with Reverse Tunnel

  1. From the left menu, select Session Management > Servers and click + Add server.

  2. Enter a name (e.g., RDP_Reverse_Server).

  3. In the Settings section, choose RDP as the protocol.

  4. Select the Use SSH tunnel option, and paste the jump host public key into the SSH tunnel key field.

  5. Click Save.

  6. After saving the server, copy the command displayed in the Command to establish SSH tunnel field.

Note

Unlike in a standard server configuration, the IP address and port are not defined in the Destination section, because the server is accessed through an SSH reverse tunnel.

Account Configuration

  1. Select Session Management > Accounts, then click Add account.

  2. Enter a name (e.g., Reverse_Tunnel_Account).

  3. In the Settings tab, under Type, select REGULAR.

  4. In the Target section, select the RDP_Reverse_Server.

  5. In the Credentials section:

    • Enter the login used on the target server (e.g., admin).

    • Click the button in the Replace secret section, choose e.g. Password, and enter the password used to authenticate on the target server.

  6. Click Save, then Save and exit.

Safe Configuration

  1. Select Session Management > Safes, then click Add safe.

  2. Enter a name (e.g., Reverse_Tunnel_Safe), click Save.

  3. In the Users tab, click Manage users and select the Tunnel_User.

  4. Click Save.

  5. In the Accounts tab, click Manage accounts and select Reverse_Tunnel_Account.

  6. Click Save.

  7. Select Reverse_Tunnel_Account, click Manage listeners, select SSH_Tunnel.

  8. Click Save, then Save and close.

Establishing Tunnels and Initiating the Connection

  1. On the jump host server, run the command generated when creating the server in Fudo Enterprise to establish the tunnel. The command contains the identifier of the created server (8754997675608244234), which is used when establishing the tunnel and initiating the connection.


Example:

ssh -l tunnel -p 65522 -o ExitOnForwardFailure=yes -N -f -R /tunnel/8754997675608244234:<target>:<port> 10.31.135.179

where you should replace:

  • <target> - with the IP address of the target server

  • <port> - with the port of the target server

  1. On the user’s machine, from which the connection to the target server will be initiated, establish a tunnel to the listener.

ssh -N -l <fudo_username> <fudo_listener_ip> -p <listener_port_tunnel> -L <listener_port_tunnel>:/tunnel/<server_id_on_fudo>

Example:

ssh -N -l 'tunnel_user' 10.31.135.179 -p 3455 -L 3455:tunnel/8754997675608244234

where:

  • 'tunnel_user' - the username in Fudo Enterprise.

  • 10.31.135.179 - the listener address.

  • 3455 - the port of the Tunnel-type listener.

  • 8754997675608244234 - the ID number of the server created in Fudo Enterprise.

  1. Initiate the connection through the tunnel using the server name configured in Fudo Enterprise.

ssh -l '<fudo_username>#<server_username>#<name_of_server_on_fudo>' localhost -p <listener_port_tunnel>

Example:

ssh -l 'tunnel_user#admin#RDP_Reverse_Server' localhost -p 3455

  1. Depending on the protocol of the target server (in this case, RDP), launch the appropriate native client and connect to localhost:3455.


Related topics: