Tunnels

[lavrd]

Hi, thanks for the project!

As I can see there is source code to access MySQL through Warpgate and for PostgreSQL source code is need too. But I am thinking about different approaches to achieve it:

• SSH Tunnel / Port Forwarding - add a public key in admin UI and (or use password like it works now) and then make ssh connecting with port forwarding (as I understand at the moment we can't do it because Warpgate tries to make a hop to another server)
• TCP Proxy - it requires cli tool, which will do auth and start local tcp server, then start tcp server using Warpgate and make proxy to services like databases

What do you think?

If it is valid proposals and you need it I can try to help with implementation.

[Eugeny]

Could you please explain your question in a bit more detail?

Currently there is support for native MySQL tunnelling without the need for SSH port forwarding - you add MySQL targets to in the admin UI and then connect your MySQL clients to Warpgate directly.

Similar support for PostgreSQL isn't implemented yet but is planned

[Eugeny]

• Plain TCP tunneling requires some sort of authentication/control protocol, which in turn requires a client application. Avoiding the need for a "warpgate client" is the whole point of this project :)
• SSH port forwarding already works - but you obviously need an SSH server as a target for that

[lavrd]

Understand the first point. But about second one. As I understand at the moment I need to do another hop to the different SSH server, right? So I can't just open SSH connection with port forwarding on the host with Warpgate and make a connection to database.

What I see now:

• setup server with Warpgate
• setup server with access to database
• make a SSH target from Warpgate to server with database access
• start tunnel through SSH

Is it right? If so, it would be great to do it without second server.

[Eugeny]

Ohh now I get it! This is a great idea, I'll make an feature ticket

[lavrd]

Super! Do you need any help or maybe I can try to implement it?

[Eugeny]

Sure! If you've got time to work on it, it'd be awesome. This would be a new Target type, and since it reuses the same "server side" protocol (SSH), you can probably get away reusing warpgate-protocol-ssh and just replacing its RemoteClient (the SSH client part) with an implementation that directly connects to a target port when asked to forward a port.