Skip to content

Commit

Permalink
Add note on disabling proxy proto v2 and on localhost
Browse files Browse the repository at this point in the history
Signed-off-by: Alex Ellis (OpenFaaS Ltd) <alexellis2@gmail.com>
  • Loading branch information
alexellis committed Feb 5, 2024
1 parent 4681d6f commit bbad61a
Showing 1 changed file with 12 additions and 4 deletions.
16 changes: 12 additions & 4 deletions blog/_posts/2024-02-05-access-all-your-ssh-servers-with-sshmux.md
Original file line number Diff line number Diff line change
Expand Up @@ -63,7 +63,7 @@ Add `--proxy-protocol="v2"` to the `ExecStart` line as an additional argument.

Then restart the server with `sudo systemctl daemon-reload && sudo systemctl restart inlets-pro`.

Next create a config.yaml file on a computer in your private network. You can think of this machine as being like a jump box, or a bastion host. The `sshmux server` will run here in order to forward connections to your other servers.
Next create a config.yaml file on a computer in your private network. You can think of this machine as being like a jumpbox, or a bastion host. The `sshmux server` will run here in order to forward connections to your other servers.

```yaml
# config.yaml
Expand All @@ -77,9 +77,11 @@ upstreams:
I've used the IP addresses of my machines on my local network in the `upstream` field. You can also use a DNS name here like `raspberrypi.local`, so long as you first add an extra in `/etc/hosts` such as `raspberrypi.local 172.10.0.101`.

Update inlets-pro on both your jump box and wherever you are going to run the client. You can use `inletsctl download` or `arakde get inlets-pro` to get the latest version. Alternatively, there's the [GitHub releases page](https://github.com/inlets/inlets-pro/releases).
If you also want to expose the jumpbox in the list of upstreams, that's fine, but don't use the value `127.0.0.1`, instead use its local network IP address.

Run the `sshmux server` on the jump box:
Update inlets-pro on both your jumpbox and wherever you are going to run the client. You can use `inletsctl download` or `arakde get inlets-pro` to get the latest version. Alternatively, there's the [GitHub releases page](https://github.com/inlets/inlets-pro/releases).

Run the `sshmux server` on the jumpbox:

```bash
inlets-pro \
Expand Down Expand Up @@ -113,7 +115,7 @@ Host *.inlets

Just update TUNNEL_IP to the IP address of the exit server VM.

Now you can use the `nuc.inlets` and `rpi.inlets` hostnames to connect to your servers.
Now you can use the `nuc.inlets` and `rpi.inlets` aliases to connect to your servers just like if you were addressing them on your home network as `nuc` and `rpi`.

```bash
ssh nuc.inlets "uname -a && uptime"
Expand Down Expand Up @@ -142,6 +144,12 @@ ssh -L 8080:127.0.0.1:8080 octoprint.inlets

Then access it via `http://127.0.0.1:8080` in your web browser.

## Do you need to use this TCP tunnel server for other things?

If you also want to use the same TCP tunnel server for other things in addition to SSH like the kubectl API server, then make sure they support and are configured to expect PROXY protocol v2.

If not, you can either run two separate TCP tunnel servers, or turn off PROXY protocol on both the tunnel server by adding `--proxy-protocol=""` to the `inlets-pro tcp server` command and on sshmux server by adding `--disable-proxy-proto` to `inlets-pro sshmux server`.

## Wrapping up

In a very short period of time, a prototype written over the FOSDEM weekend has made it into the inlets-pro product. It's not the only way to connect to various machines with your local network, but it's a very simple and effective way to do it if you're already using inlets.
Expand Down

0 comments on commit bbad61a

Please sign in to comment.