I have an existing setup as follows, workstation <-> Maas server <-> VM's.

The Maas server has two interfaces, eth0 has a static address of 192.168.x.x and the eth1 has 10.4.x.x. eth1 is also acting as DHCP manager for the VM's. My workstation's ip is 10.x.x.x and I can ssh the Maas server. The Maas server in turn is also ssh connect to the VM's. Because the workstation and VM's are on a different network I can't connect to the VM's directly.

I tried reverse SSH tunneling with,

ssh -R 6333:localhost:22 akh@192.168.x.x 

from one of the VM's to the Maas server. Afterwards I tried to connect from my workstation to the VM using,

ssh akh@192.168.x.x -p 6333

But I repeatedly get this error, 'Permission denied (publickey).'

I have already copied my public key to in the VM's authorized key files, but I get same error. Is there maybe another method to connect from the workstation to the VM ! If so, please advise.

  • 1
    If you use ssh -v (verbose) you will have an hint on where it is failing --- maybe it can help. – Rmano Nov 13 '14 at 15:26

Let me suggest you to use sshuttle, it easily creates a 'vpn' over ssh in your workstation run the following commands:

$ sudo apt-get install sshuttle
$ sshuttle -r akh@192.168.x.x 10.x.x.x/24  # /24 is the subnet

Then in another terminal (also in workstation) you should be able connect automagically to any host in 10.x.x.x/24 subnet.

I do this all the time, I really recommend you to use sshuttle.

  • do you also use the sshuttle to connect to the instances created in the compute node ! – Akh Nov 13 '14 at 17:03
  • if the instances get a 10.x.x.x/24 IP then you'll be able to connect transparently, that's my case for floating IPs. I'm not sure if sshuttle can be used jump twice to reach a host. – Felipe Reyes Nov 14 '14 at 12:29

You can configure your MaaS server to route between your workstation and the target VMs.

Enable IP forwarding: echo 1 > /proc/sys/net/ipv4/ip_forward

To ensure it is persisted, you should also edit /etc/sysctl.conf and make sure that the line net.ipv4.ip_forward=1 is not commented.

Then, you can add a static route on your workstation that redirects the traffic for the VMs through the MaaS server. Assuming that your workstation is running ubuntu, you can execute this command:

route add -net 10.4.x.x netmask gw 192.168.x.x

You should also persist this static route in /etc/network/interfaces.

This is valid for recent Ubuntu version, I have tested it on 12.04 and newer.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.