Ssh port forwarding with Remote Desktop timing out

Question

My work computer, a Windows 7 Enterprise PC called WORKPC, is running Remote Desktop. I have configured Windows Firewall on WORKPC to allow access to the Remote Dekstop service from only two IP addresses: IP1 and IP2.

IP1 comes from a commercial VPN service that allocates me a static IP address. When I go home and run the VPN client I can connect to WORKPC using the Remote Dekstop client with no problem.

IP2 is the address of a Linux server GATEWAY at work I can ssh into from home. In order to use IP2 to remote desktop to WORKPC I use ssh and port forwarding on IP2:

ssh -vvv -L 1234:WORKPC.example.org:3389 GATEWAY.example.org

When I attempt to remote desktop from home using this port forwarding technique, I get the following error on my ssh connection:

debug1: Connection to port 1234 forwarding to WORKPC.example.org port 3389 requested.
debug2: fd 9 setting TCP_NODELAY
debug3: fd 9 is O_NONBLOCK
debug3: fd 9 is O_NONBLOCK
debug1: channel 3: new [direct-tcpip]
channel 3: open failed: connect failed: Connection timed out

To verify that port 3389 was open on GATEWAY I did a telnet 3389 and got a connection, so I am certain that port 3389 on WORKPC is open to GATEWAY.

Here is the configuration information:

# /etc/ssh/sshd_config
# sshd running on Debian wheezy
Port 22
Protocol 2
HostKey /etc/ssh/ssh_host_rsa_key
LoginGraceTime 300
MaxAuthTries 5
IgnoreRhosts yes
RSAAuthentication no
PubkeyAuthentication no
RhostsRSAAuthentication no
HostbasedAuthentication no
ChallengeResponseAuthentication yes
PasswordAuthentication no
UsePAM yes
PermitEmptyPasswords no
X11Forwarding yes
X11DisplayOffset 10
PrintMotd no
TCPKeepAlive yes
Subsystem sftp /usr/lib/openssh/sftp-server

I would prefer to use the ssh proxying method over paying the commercial VPN service to rent a static IP address. Can anyone suggest something I can try to get this to work?

Answer 1

Does the name WORKPC.example.org resolve correctly at GATEWAY? When forwarding ports the destination is resolved at the server, not the client, so any hostname errors will give symptoms like you describe. Try using WORKPC's ip-address in your ssh command-line.

Does WORKPC only have a public IP address, or does it have a private internal IP address that is NATted by a firewall? If GATEWAY sees the private internal IP address, that is what you should use in setting up your SSH tunnel.

Answer 2

Your ssh command might need an account-name, like :

ssh -L 1234:WORKPC.example.org:3389 [email protected]

Answer 3

It's quite old question, but for me problem was in -L 1234:WORKPC.example.org:3389 part. Host workpc.example.org is known by a router, but not by PC itself. So traffic goes from SSH endpoint via router again to port 3389, which is blocked by a firewall. -L 1234:127.0.0.1:3389 works.