Hacker News Reader

Comment by mjg59 | Hacker News Reader

Depends on the protocol. For web, sure - for ssh, nope, since the protocol doesn't indicate which machine it's trying to connect to and so you don't know where to proxy it to.

View on HN

You can still TCP proxy SSH just fine (one port per target host obv)

Certain UDP-based protocols may be hairier, though.

I don't know what you mean by "the protocol". There is a destination IP address on every packet... getsockname() will tell the proxy which local IP the client dialed, allowing it to create "virtual hosts" (or you can actually run multiple proxies bound on different local addresses).

I have one public IP address. I have three machines behind it that I want to SSH into. How does the machine with the public address know where to route an incoming port 22 packet? For HTTPS this is easy - browsers send the desired site in the SNI field of the TLS handshake, so the frontend can look at that and route appropriately. For SSH there's no indication of which host the packet is intended for.

Well you can't, but that wouldn't work with routing either, and it is not the situation at hand: in the article there are multiple IPs on the VPS:

> you now have multiple real-world IP addresses that people can get to

In your new situation that is not the one in the article, you can just use different ports.

HTTPS and any other protocol that uses TLS has virtual hosting (because TLS has virtual hosting), and so does unencrypted HTTP (with the "Host" header), and some "small web" protocols such a Spartan and Scorpion. (In the case of Spartan, the domain name is the first thing the client sends to the server, which should make it easy to implement.) Like you mention, SSH does not. IRC and NNTP also do not have virtual hosting as far as I can tell, although I had suggested to add a HOST command to these protocols to implement virtual hosting.

Note that this is not the only meaning of "virtual hosting". It is very commonly used with different addresses or ports. For example, the Apache `<VirtualHost addr:port>` block. It gets confusing because this is the same block that was used for "named-based virtualhost" (different `ServerName` in the same `<VirtualHost>`). See https://en.wikipedia.org/wiki/Virtual_hosting

Socket based proxying is better for this, since you eliminate one point from your attack surface (if your proxy server gets compromised, it's just encrypted ssh/TLS)

Reply on news.ycombinator.com