Ssh – scp between two servers not in the same network

routingscpsshvlan

There are two server that I can access with 2 different VPN connections. I have managed to have both VPN working on the same time on my machine (a bit of routing rules).

I want to do a scp <remote1>:some/file <remote2>:destination/folder from my laptop terminal. But when I try this, the scp command that is invoked on remote1 cannot find remote2 because they are not in the same network. Is it possible to force the scp command to pass through my laptop as a router?

If I try with Nautilus (connect to server, both servers, then copy-paste) it works, but I'd like to do it from a terminal.

Best Answer

Newer versions of scp have the option -3

-3

Copies between two remote hosts are transferred through the local host. Without this option the data is copied directly between the two remote hosts

Related Solutions

Ssh – How to set up ssh server with VPN tunnel? (Policy routing for sshd service)

Yes, I found answer here (by coincidence).
This setup on the [B] machine solved the problem:

ip rule add from 192.168.1.X table 128
ip route add table 128 to 192.168.1.0/24 dev eth1
ip route add table 128 default via 192.168.1.1

I guess credits to user AGWA.

OpenVPN – Understand the routing table + How to route only the traffic to a specific ip via the VPN

I don't understand the second default gateway, this is the default when the vpn is not active, is it simply bypassed?

This is one of OpenVPN's hacks to route traffic through your tunnel while maintaining your default gateway. The 0.0.0.0/1 and 128.0.0.0/1 routes take precedence over the 0.0.0.0/0 route since they are more specific while still matching all addresses. Search for "def1" in the OpenVPN documentation for more detail

What about the 10.7.7.1? looks like it is the gateway of the vpn...

Probably, yes

OpenVPN automatically creates all these rules. But based on what are those created?

They are probably pushed from the server. I can provide more information if you can provide the output from your client while it's starting along with your configuration file

I cannot control the server side of the VPN but only the client configuration.

Yep, but the client is highly configurable such that you can override pretty much anything the server wants your client to do. Still, you'll need to meet your providers basic requirements in order to connect. You should also check your providers "Terms of Use" to make sure you don't end up pissing them off.

Now what if I would like to:

force all traffic to 216.58.213.174 to go via VPN tun0 and have all the rest going through eth0?

Yep, include "route 216.58.213.174 255.255.255.255 10.7.7.125" in your config. That should setup your desired route. You should be able to keep your other routes in place by removing the "redirect-gateway" option from your configuration

can I have it established automatically when starting the VPN?

yes, see above

All of the options I've described and more can be found in OpenVPN's online documentation. https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage

Best Answer

Related Solutions

Ssh – How to set up ssh server with VPN tunnel? (Policy routing for sshd service)

OpenVPN – Understand the routing table + How to route only the traffic to a specific ip via the VPN

Related Question