SMB proxy: Connect to SMB server through SSH tunnel between two other hosts

Question

I want localhost to access my company's SMB shares. These are located on a Win7 peer. This peer is running a virtual machine with Debian which itself is running an ssh daemon.

I can easily create an ssh tunnel from localhost to the VM but couldn't get SMB forwarding/proxying to work. I read too much on this ending up totally confused on which port on which interface and host to forward to and the like...

If I'm right I have to forward localhost's port 139 to a port on my proxy and on the proxy itself forward port 139 to the port of the ssh tunnel on the same host? Is this supposed to work at all? How should I set up each host to accomplish that?

The network roughly looks like this:

localhost ===(ssh)=== |router| ===(ssh)=== debian vm ===(smb)=== win7

The router just forwards the SSH connection to the VM.

Solution

The answer that @Zoredache gives to this question is a good one for what you're looking to do, though I'm going to elaborate on it for your situation.

It's not clear to the if the router is running an SSH server from your diagram or if you're just saying that you're going to be moving SSH traffic through it. I'm going to assume you're just moving SSH traffic through it via a port-forward, in which case I'd:

• Start an SSH session from your PC to the public IP address of the router which, presumably, has a port forwarded to the Debian VM's SSH server port

• Forward port 139 on your PC, specified as 127.0.0.2:139, to the LAN IP address of the Windows 7 PC, port 139 (this assumes the Debian VM can access the Windows 7 PC). If you're using OpenSSH the syntax would be ssh router-ip -L 127.0.0.2:139:win-7-pc-ip:139

• Create a /etc/hosts (or whatever analog to that exists on your OS) to resolve the name of the Windows 7 PC to 127.0.0.2

This will allow you to access the Windows 7 PC, by name, via a local loopback address that forwards to the SMB port on the Windows 7 PC.

Comments

[pong]

Evan, your assumptions are right, sounds like your solution should work. You cut the Gordian knot inside my brain, didn't thought about the possibility of forwarding to a third host directly. Maybe my thinking partially derives of what happens internally on the remote SSH? Regardless of that I will just try it your way and probably succeed, thanks a lot so far!

[pong]

Easily worked out your way, thank you! Might had to use port 445, can't tell as of now which one actually did the job.

[Machavity]

Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference.

[azrdev]

well @Machavity I actually did include the relevant info from the link