Title: ssh tunnel with intermediary machine using named pipes and without listening on any ports on the intermediary
Tags: ssh;ssh-tunneling;netcat
Question: I would like to use an intermediary host to tunnel between two other hosts which are both behind firewalls, and cannot accept incoming connections. For security reasons, I wish to avoid having any open sockets listening on any interfaces on the intermediary host.
I was thinking this could probably be accomplished using a combination of netcat and ssh, with netcat mediating the connection on the intermediary host using named pipes or unix domain sockets.
Both host-A and host-B can connect to intermediary-host using ssh.
I then want to set it up so that host-B can connect to host-A over the an ssh-netcat tunnel established on the intermediary host.
Here is a lame network diagram:
fw                                 fw
||         [host-I]                ||
[host-A]--&gt;{ssh}--&gt;||-----&gt; [intermediary-host] <-----||<--{ssh}<--[host-B]
<sshd on port 22&gt;  ||  {netcat + unix-socket-or-pipe} ||   <listen: 2222&gt;
/\           ||         /         \             ||   {ssh -p 2222}
\           ||        /           \            ||    /
\<---------==-----< /             \ <---------==--</
||                                 ||
So, I'm not sure how to invoke ssh+nc on each host to make this work.
Comment: If you could control both ends then you could setup a single connection between them.  But it wouldn't give you the ability to simply leave host A waiting for a connection, and log in from B whenever you want.

Comment: Given the criteria you've stated in your question, it's not possible. Your A and B hosts can connect to the intermediary, C, but not to each other. You want A to get to B via C but you don't want anything listening on C. Therefore nothing can carry traffic from A to B (or B to A). You need something listening on C. It need only be on the local (internal) interface, but something must listen. And if something is listening on C then it's a standard proxy solution, of which we have several on this site.

Comment: @PhilipCouling - I can access both ends simultaneously (one side via citrix) and I'm trying to get better remote access without the horrors of citrix+windows. So, I really only want a short term tunnel while my citrix session is active. So, how would I get the single connection between host-A and host-B via host-I?



{'source': 'StackExchangeDataset', 'subset': 'unix.stackexchange.com', 'metadata': {'AnswerCount': 0, 'CommentCount': 3, 'ContentLicense': 'CC BY-SA 4.0', 'CreationDate': '2019:00:03/08/19', 'FavoriteCount': 1.0, 'PostTypeId': 1, 'Tags': '<ssh><ssh-tunneling><netcat>', 'Title': 'ssh tunnel with intermediary machine using named pipes and without listening on any ports on the intermediary', 'ViewCount': 203, 'id': 505222, 'user_AboutMe': '<p>deeply</p>\n', 'user_AccountId': 2336765.0, 'user_DisplayName': 'Mylo Stone', 'user_Reputation': 1.0, 'user_Views': 5.0, 'user_id': 238465.0}}