我正尝试从 WAN 访问位于同一本地网络上的两台不同机器的 VNC 服务器。
因为我希望该流量在 SSH 隧道中进行路由，所以我使用 然后 ，第一台机器没有任何问题。ssh [email protected] -N -L 15900:127.0.0.1:5900vnc://[email protected]:15900
对于第二台机器，我将端口 2222 NAT 到路由器中这台机器 IP 的端口 22。NAT 还配置为将端口 5900 转发到第一台机器的 IP，将端口 5901 转发到第二台机器 IP 的端口 5900。
我以为那样 就会 起作用，但事实并非如此。ssh -p2222 [email protected] -N -L 15901:127.0.0.1:5901vnc://[email protected]:15901
我运行该命令的 shell输出：ssh -p2222 [email protected] -N -L 15901:127.0.0.1:5901
通道 2：打开失败：连接失败：连接被拒绝
当我尝试通过 VNC 进入机器时。
我试过ssh -v -p2222 [email protected] -N -L 15901:127.0.0.1:5901
我得到了：
OpenSSH_6.2p2, OSSLShim 0.9.8r 8 Dec 2011
debug1: Reading configuration data /etc/ssh_config
debug1: /etc/ssh_config line 20: Applying options for *
debug1: /etc/ssh_config line 102: Applying options for *
debug1: Connecting to xxxxx.net [xx.xx.xx.xx] port 2222.
debug1: Connection established.
debug1: identity file /Users/admin/.ssh/id_rsa type 1
debug1: identity file /Users/admin/.ssh/id_rsa-cert type -1
debug1: identity file /Users/admin/.ssh/id_dsa type -1
debug1: identity file /Users/admin/.ssh/id_dsa-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.2
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.2
debug1: match: OpenSSH_5.2 pat OpenSSH_5*
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Server host key: RSA xx:xx:xx:xx
debug1: Host '[xxxxx.net]:2222' is known and matches the RSA host key.
debug1: Found key in /Users/admin/.ssh/known_hosts:60
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,keyboard-interactive
debug1: Next authentication method: public key
debug1: Offering RSA public key: /Users/admin/.ssh/id_rsa
debug1: Server accepts key: pkalg ssh-rsa blen 535
debug1: read PEM private key done: type RSA
debug1: Authentication succeeded (public key).
Authenticated to xxxxx.net ([xx.xx.xx.xx]:2222).
debug1: Local connections to LOCALHOST:15901 forwarded to remote address 127.0.0.1:5901
debug1: Local forwarding listening on ::1 port 15901.
debug1: channel 0: new [port listener]
debug1: Local forwarding listening on 127.0.0.1 port 15901.
debug1: channel 1: new [port listener]
debug1: Requesting [email protected]
debug1: Entering interactive session.
debug1: Connection to port 15901 forwarding to 127.0.0.1 port 5901 requested.
debug1: channel 2: new [direct-tcpip]
channel 2: open failed: connect failed: Connection refused
debug1: channel 2: free: direct-tcpip: listening port 15901 for 127.0.0.1 port 5901, connect from 127.0.0.1 port 51974, channels 3
有人知道吗？
答案1
如果我正确理解了网络布局，那么您误解了 SSH 隧道如何与 NAT 交互。基本上，一旦 NAT 路由器将您的 SSH 连接从 externalIP:2222 转发到 privateIP1:22，NAT 就完成了其工作，不再起作用。
要获得与第二台内部计算机的 VNC 连接，您需要建立一条隧道，该隧道将从本地计算机的端口 15901 开始，通过 SSH 连接到达第一台内部计算机，然后从那里到达第二台内部计算机。您可以使用 执行此操作。ssh -p2222 [email protected] -N -L 15901:privateIP2:5900
您所缺少的是“privateIP2：5900”部分；您的版本告诉第一台计算机将连接转发到端口 5901 上的自身（127.0.0.1）；那里没有任何内容在监听，因此它会被拒绝。
你做不是希望 NAT 盒将端口 5900 和 5901 转发到任何地方——这将允许任何人从任何地方通过 VNC 进入这些计算机并完全忽略 SSH 隧道。