macos - How to ssh to an unreachable remote machine by tunneling through a server that everyone can reach?

Machines:

• Let's call my machine macbook.


• I have a server on tah interwebs. Call it server.


• I have a Mac Mini elsewhere that I can access via iChat screen sharing. Let's call it mini.

Reachability:

• server can see neither macbook nor mini.


• macbook can see server but not mini.


• mini can see server, but not macbook.

Screen sharing is slow. I want an SSH connection to mini. A direct connection is impossible because of routers, NAT, etc.

What I want to do is to connect both macbook and mini to server via SSH, creating the approriate tunnels, so that from macbook I can run a ssh … command to connect to mini by tunneling the connection through server.

So my question is, what commands do I have to run, on which machines, to make this work?

To keep it simple, please use server, mini, macbook as hostnames in your answers.

Answer

Only one ssh tunnel is needed. From the mini:

ssh -N -R 0.0.0.0:8022:localhost:22 serverUser@server

Now you can just connect from macbook onto server with ssh -p 8022 miniUser@server

Be sure to have GatewayPorts set to yes in the server's /etc/ssh/sshd_config.

Additionally you may want to define some stuff in ~/.ssh/config:

Host gate.mini
    HostName server
    Port 8022
    HostKeyAlias mini

This allows you to do the more coherent ssh miniUser@gate.mini, and at the same time not be bothered with server fingerprint mismatches.