My machine at work is behind a firewall. To connect to it first i need to connect (ssh) on another machine and then through this machine i make the ssh on my machine. In other words, there is a middle machine between my local computer and the final remote computer. How can i create an encrypted tunnel between my local computer and my computer at work?
Note: Using OpenSSH
In reading your question I have to assume “my local machine” is outside the company network, like in your home or somewhere on the Internet. More well defined locations, operating systems in use and a brief description of your company environment would assist those attempting to answer questions. For the purpose of this response I'm going to give systems identified in your question some names.
“my work machine” = work-machine
"my local machine” = home-machine
“another machine” = jumpbox
This is really a matter of company security policy. Connections from the Internet to systems on a company's internal network are typically not allowed because they provide a path for attackers to access internal resources and ex-filtrate data. I can only assume that the jumpbox you are connecting to is a gateway device (preferably in a DMZ) that exists for some combination of authentication, authorization and accounting, and potentially inspection.
That being said, if policy permits, you would need to have your firewall administrator permit connections from your home-machine to your work-machine. This is typically undesirable if you're coming from a dynamic IP address that will change over time, as the firewall administrator will need to allow broad ranges of IP addresses in to the network. Ideally, if inbound connections are permitted to your company network you will always come from the same IP address when connecting from your home-machine.
Alternatively, you could use a reverse tunnel using SSH; again, if your company policy allows outbound SSH connections. The -R option in SSH allows you to build reverse tunnels. For this you would require a method of connecting form your work-machine to your home-machine. You'll need to consider following items: 1. Name resolution (if your IP changes at your house): There are plenty of dynamic DNS providers out there. 2. Port forwarding if you're behind a NAT device, such as a DSL router. 3. Your home-machine or another dedicated system would have to be running SSH server to accept the ssh sessions coming from your work-machine.
Once you've configured services required in 1-3 above, you can make a connection from your work-machine to the SSH server running at your house. From your work-machine, the command might look like this:
ssh -R 192.168.12.202:5556:127.0.0.1:22 [email protected]:4444
If I were to speak the command above, it would go like this: Use ssh to create a reverse tunnel (-R), opening a listing port (5556) on my ssh server (192.168.12.202). As clients connect to port 5556, forward them to port 22 on my ssh server (127.0.0.1), which is subsequently forwarded back to the machine originating the tunnel (work-machine).
There are a lot of technical tutorials out there which provide instructions for building reverse tunnels with SSH.
