WebSocket over SSH tunnel - is it possible?


 
Thread Tools Search this Thread
Special Forums IP Networking Proxy Server WebSocket over SSH tunnel - is it possible?
# 1  
Old 01-13-2015
Computer WebSocket over SSH tunnel - is it possible?

Hello,

I have a video streaming application that utilizes a WebSocket for the server <-> client communication. My goal is to make the video streaming service available over the internet in the cases where neither the server nor client have public IPs.

One way to do this is over a VPN connection, but I prefer not to use a VPN at all. That's why I decided to try and forward the communication over an SSH server via remote port forwarding.

However I am facing an issue - forwarding the server socket is pretty straight-forward, but I have no way to know in advance what the randomly allocated client port will be, so the traffic will flow only in the direction client -> SSH server -> streaming server.

When the SSH relay point receives the responses from the streaming server it does not automatically route them back to the client and the WebSocket handshake cannot be completed.

Do you think it is possible to overcome this issue or should I drop the WebSocket altogether and revert to a normal HTTP / TCP connection?

Thanks!
# 2  
Old 01-13-2015
Be more specific please. What, exactly, does the WebSocket try to connect to?
# 3  
Old 01-13-2015
The setup is quite simple actually - there is a WebSocket server and a WebSocket client connecting to it.

My idea is to be able to indirectly access the WebSocket server by forwarding it's listening port to a machine with a real IP address. (in the case when the server is behind a router or firewall and using standard NAT forwarding / routing is not an option - e.g. on two devices accessing the Internet through a mobile data connection)

The problem is that the WebSocket client will always allocate a random port when initializing the communication and the SSH-relay point has no idea how to handle the responses coming from the server on that port.

What makes it even worse is that SSH will open yet another TCP socket (again on a random port) which will be then used to forward the client's request to the actual WebSocket server over the SSH tunnel.
So, if I want to make this work I will have to build a second SSH tunnel from the WebSocket client, in an attempt to bridge the SSH generated client socket to the original one, which makes this a somewhat complicated task...
# 4  
Old 01-13-2015
Quote:
Originally Posted by Vladislav
The problem is that the WebSocket client will always allocate a random port when initializing the communication and the SSH-relay point has no idea how to handle the responses coming from the server on that port.
An SSH tunnel might not be the right tool for the job then, a VPN sounds more suitable. The VPN itself will communicate on a predictable IP and port, but to the applications on either side, can generate traffic that appears to come from another subnet, as if you had two new network cards and a miles-long cable connecting you two directly. Hence 'virtual', 'private', and 'network'.
# 5  
Old 01-13-2015
Yes, I completely agree.

Also, I am well aware of what a VPN is and how it functions, but as I said in my original post I would like to avoid using it. I am trying to achieve a functionality similar to what TeamViewer does, but now it seems that the easiest way to do that would be through a regular TCP socket connection over application-configurable port numbers.
# 6  
Old 01-13-2015
You asked for forwarding when you knew it wouldn't work, and now want teamviewer?

VNC. Though if you can't arrange port forward forward for that you'll need VPN too.
# 7  
Old 01-14-2015
Quote:
Originally Posted by Corona688
You asked for forwarding when you knew it wouldn't work, and now want teamviewer?

VNC. Though if you can't arrange port forward forward for that you'll need VPN too.
Unfortunately VNC is not an option as most VNC clients use a similar networking mechanic where the client side will open a random port for the outgoing requests, which basically presents the same issue as I have with my solution...

Also, I want to use this on an Android device and grabbing frames from the FrameBuffer in Android (which VNC does) is painfully slow at 4-5 frames per second. The application that I am developing utilizes one of the newer APIs in Android, that allows streaming of the screen content much more effectively (~30 frames per second).

I investigated what TeamViewer does and it seems that they have a server side application that actively forwards the communication between the streaming server (remote controlled device) and client based on unique user IDs.

This is starting to look like my only viable solution as well, although I was hoping that there would be an easier way to achieve the same functionality...

Also, although it'll be a nice clean way to solve the connectivity problem, VPNs are not allowed in some countries. Smilie Many mobile operators nowadays have policies that force corporate users to purchase licenses for private APNs, in order to be able to use VPN connections.

I don't know what the exact reason for that is, but it has something to do with their security concerns and maybe even some old-fashioned greed. Some operators have pretty strong firewall rules and may even go as far as to block SSH tunnels (or any other type of encrypted traffic for that matter - although far less common). Exceptions are made only for well known applications like Skype, Hangouts, etc.

Last edited by Vladislav; 01-14-2015 at 10:32 AM..
Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. UNIX for Advanced & Expert Users

Tunnel using SSH

I am not clear with the part of concept of Tunneling using ssh. ssh -f -N -L 1029 192.168.1.47:25 james@192.168.1.47 I found out that above code works for me . but didn't quite well understood how ti works and need to ask you guys some questions. since we are using tunnel through ssh ... (2 Replies)
Discussion started by: lobsang
2 Replies

2. Solaris

Tunnel X over ssh for 11.3

Hello Solaris experts: Trying to bring the 11.3 gdm screen over ssh to a Linux Box: I did the following: 1. made chanes to /etc/ssh/sshd_config & bounced ssh daemon: # X11 tunneling options X11Forwarding yes X11DisplayOffset 10 X11UseLocalhost yes 2. From the remote Linux box: ... (6 Replies)
Discussion started by: delphys
6 Replies

3. UNIX for Advanced & Expert Users

Ssh tunnel question

Hi all I have a suite of scripts that ssh to remote servers within a cluster and run some tests. This is done from a central server so that all of the test results can be captured in one location. Problem is I now have 509 tests and the number is growing. The scripts work by establishing a... (2 Replies)
Discussion started by: steadyonabix
2 Replies

4. IP Networking

Help with SSH tunnel?

I have a Java web app on machine (X) that needs to talk to an LDAP server (Y) on :636, but the LDAP server is only accessible on a particular network. I can login to a machine (Z) on that network from X, and this machine can talk to the LDAP server on :636. How can I tunnel so that X can... (2 Replies)
Discussion started by: spacegoose
2 Replies

5. UNIX for Dummies Questions & Answers

SSH tunnel working for ssh but not for sshfs

I'm trying to setup a link between my home pc (work-machine) and a server at work (tar-machine) that is behind a gateway (hop-machine) and not directly accessible. my actions: work-machine$ ssh -L 1234:tar-machine:22 hop-machine work-machine$ ssh -p 1234 user@127.0.0.1 - shh access on... (1 Reply)
Discussion started by: Vathau
1 Replies

6. Cybersecurity

RDP over SSH Tunnel

Hi all, I'm trying have an alternative way of connecting into a Corporate network. Mostly in case the VPN down as I cannot also change the security policy. I want to expose windows RDP over ssh tunnel. I have 3 hosts in my scenario 1- Host a : Windows 2k8 has no internet access just only an... (3 Replies)
Discussion started by: h@foorsa.biz
3 Replies

7. IP Networking

ssh tunnel with 2 hops and key

I have situation: - localhost L - server A - server B (currently accessible only from B, but it have key of my localhost - added when L have different location and can access directly to B) problem: how set tunnel from L to B and use key from localhost (I don't remember password to B)? I... (0 Replies)
Discussion started by: lessmore
0 Replies

8. UNIX for Advanced & Expert Users

Stopping SSH tunnel

I have initiated a tunnel for vncserver. now i want to stop it. is there any way except sleep option? (2 Replies)
Discussion started by: majid.merkava
2 Replies

9. UNIX for Advanced & Expert Users

ssh decipher a tunnel

Two question here, but it's only one on the protocol point of view. If two persons use the same key to connect to a SSH server is there a risk they can decipher the other tunnel. In other terms is that less safe than if they have two separate keys. Same question if two persons use the same user... (2 Replies)
Discussion started by: moi
2 Replies

10. Programming

using a ssh tunnel with nx compression

hi everybody and thank you for this wondefrul forum this is my first thread posted here and i hope that i could find some help from your part (i am even sure) :D here is the situation: i am to develop an application of remote desktop access such as vnc, vpn and especially nx i want to develop... (0 Replies)
Discussion started by: bolboln01
0 Replies
Login or Register to Ask a Question