FQDN not Resolving
-
@Dashrender said:
I think an SSL VPN client requires local admin rights to be able to do the same thing,
Think about the fact that every HTTPS web page has a VPN tunnel opened by the user. They are able to open that channel without needing admin rights. Same here.
-
@Dashrender said:
, but really only RDS, not other applications running on Windows, say the accounting softtware - that would require a full blown VPN Client install, or a SSL VPN client that did the same as the full blown one, and installed itself into the network stack.
?I don't understand what you are thinking here. Why do you feel that apps need to be that way?
-
@Dashrender said:
@johnhooks said:
@Dashrender I wanted to do a quick demo for you. This is on my Chromebook, but I used the default SSH app, because most people aren't going to have it set up the way I do. I used ChromeRDP and attempted to connect to 127.0.0.1:8080 to show it wouldn't work, then connected normally to my Server 2012. Then, I ssh with tunneling and connect to Server 2012 at 127.0.0.1:8080.
But Chromebooks are based on Linux, so it's not the same as doing it on windows.
So with Chromebooks I totally understand how this is working... you are opening a terminal session to your local machine.. then running a command which will interact with the network stack.
It's the same as here. You add the arguments in this screen:
Just the same as if you were using X11 forwarding
-
Where's the network shim come from?
If I have a local app sending packets to port 8080, and those are being forwarded to another IP on whatever port is assigned, that happens because a shim is in place, right?
a shim in this case is a good thing
-
@Dashrender said:
Where's the network shim come from?
If I have a local app sending packets to port 8080, and those are being forwarded to another IP on whatever port is assigned, that happens because a shim is in place, right?
a shim in this case is a good thing
https://chamibuddhika.wordpress.com/2012/03/21/ssh-tunnelling-explained/
localhost isn't the client you are on, you're accessing localhost on the remote system on port 8080
I guess I did say your localhost above, I apologize for the confusion.
-
@Dashrender said:
Where's the network shim come from?
If I have a local app sending packets to port 8080, and those are being forwarded to another IP on whatever port is assigned, that happens because a shim is in place, right?
a shim in this case is a good thing
No, not a shim at all, a tunnel. Very different. This is a normal application using the normal network stack. In no way is this shimming or hijacking or modifying the stack.
-
You can help me understand this later...
Where I am falling down is.... How does the locally installed RDS client know to send its traffic to the tunnel and not the normal network card?
-
@Dashrender said:
You can help me understand this later...
Where I am falling down is.... How does the locally installed RDS client know to send its traffic to the tunnel and not the normal network card?
The SSH server you log into is the one that that RDS is communicating with. Like in the image below, replace yahoo with the RDS server.
-
In looking at this graphic, the browser is on the opposite side of who is creating the SSH tunnel..
if you move the SSH to the work side... and leave the browser on that same side.. will it still work? -
The work side is creating the tunnel, and using their browser. The SSH server is on the home side.
You can easily flip it around and have the SSH server be on the work side and the home side connecting through the browser.
-
Well it only took nearly all day to understand what @johnhooks and @scottalanmiller where talking about... but now I do.
It works because the RDS client is not pointing to yourservername.domain.com or even your internal IP address.
Instead the RDS client is told to use localhost or 127.0.0.1. The local machine then, through a forwarder put in place by PuTTY sends all traffic destine for PuTTY assigned port to PuTTY and PuTTY forwards the traffic over the tunnel to port 3389 at the address set in the SSL -L command previously run.
OK I understand.
THANK the Maker! -C3P0
