Tunnels over tunnels

[sawyl]

Deflected from the things I'd intended to work on by a request from a collaborator for help tunnelling a connection from their desktop, through a series of firewalls and proxys, to the https front end of a disc array. After much puzzling over the end point of each tunnel, I eventually worked out that I needed to run one tunnel through the proxies to a machine on the same network as the array and then create a second tunnel through the in order to map a locally accessible port to 443 on the disc array at the far end of the tunnel.

Along the way, I found:

• it was necessary to use HostKeyAlias when setting up the second tunnel to prevent secure shell from complaining about the mismatch between key returned by the tunnel to a remote ssh server and its expectation that the key ought to match that of the system running the entry point to the tunnel
• it was necessary to bind the https tunnels to a different local network address, e.g. 127.0.1.1, for each unique host to prevent the browser from return an errors when accessing different servers via the same network address.

Interesting but not, I suspect, particuarly useful...