SSH Tunnels

Discussion in 'C-Bus Toolkit and C-Gate Software' started by more-solutions, Jul 20, 2011.

  1. more-solutions

    more-solutions

    Joined:
    Apr 23, 2006
    Messages:
    283
    Likes Received:
    4
    Location:
    Peterborough, UK
    I need to access a remote C-Gate over SSH. I've set up tunnelling for ports 20023-24 and 20123 using PuTTY, which basically means that once I connect via SSH those ports are open on localhost but tunnelled through the connection to the remote C-Gate. And it all seems to work.

    However, Toolkit won't let me set up a remote connection to localhost, so I have to set up the connection then connect locally in Toolkit, which on finding the relevant ports open then doesn't try to start C-Gate locally.

    My question is this: will this cause me any problems? Eg does Toolkit make any assumptions about a local connection (eg it being faster) that will make it unreliable over a slower connection?

    Also, it would be nice if I could create a "remote" connection to a port other than 20123 so that I could leave the tunnel open but still be able to switch to the real local C-Gate if necessary without having to drop the connection and start C-Gate. Is there a way to do this?
     
    more-solutions, Jul 20, 2011
    #1
  2. more-solutions

    daniel C-Busser Moderator

    Joined:
    Jul 26, 2004
    Messages:
    770
    Likes Received:
    21
    Location:
    Adelaide
    Hi Mark,

    C-Gate exposes SSL ports at 20123 - 20126 for command, event, status change and config change.

    Can I ask why you are tunnelling all your local ports to a remote machine rather than using Toolkit's own "remote C-Gate" feature?

    Toolkit establishes its own SSL connection to C-Gate, whether locally or remote. It's true that most of our other applications don't use SSL though.

    Do you have a need to secure these other connections to C-Gate, or are you constrained by the remote site's own policies? I only ask so that we can take user scenarios on board for future product design.

    But to answer your question - no Toolkit doesn't change timeouts for local versus remote connections. You will need to ensure that the remote connection is sufficiently fast - in general we've had no problems with 3Mbps broadband connections. It may work with slower connections but I can't confirm that.

    There is one difference you should keep in mind - Toolkit 1.11.6 does have an option in Preferences to shut down the local C-Gate when it exits. You would need to ensure this option is turned off.
     
    Last edited by a moderator: Jul 21, 2011
    daniel, Jul 21, 2011
    #2
  3. more-solutions

    more-solutions

    Joined:
    Apr 23, 2006
    Messages:
    283
    Likes Received:
    4
    Location:
    Peterborough, UK
    In our case we have a Linux server running C-Gate amongst other things. SSH gives us secure access via public/private key pairs which site have accepted, and we can tunnel everything else through it. Although C-Gate traffic is encrypted from Toolkit, opening the port would not restrict who was able to use it. But also we're tunnelling more than just C-Gate so one size fits all.
     
    more-solutions, Jul 21, 2011
    #3
  4. more-solutions

    ashleigh Moderator

    Joined:
    Aug 4, 2004
    Messages:
    2,397
    Likes Received:
    26
    Location:
    Adelaide, South Australia
    You could use a VPN (eg OpenVPN) and then all this would be completely transparent to you.
     
    ashleigh, Jul 22, 2011
    #4
  5. more-solutions

    more-solutions

    Joined:
    Apr 23, 2006
    Messages:
    283
    Likes Received:
    4
    Location:
    Peterborough, UK
    This is very true! Tunnelling over SSH is easier to set up and just "works" though. SSH was already in use on the server so it didn't require anything additional at that end.

    Bus OpenVPN would be an equally good solution.
     
    more-solutions, Jul 22, 2011
    #5
Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.