Client TCP/UDP and the built-in DNS server bind loopback unless bind_address or a per-rule host (tcp://22:0.0.0.0:2222) is set. README and generated server examples no longer document :9000/:8080 as if they were localhost-only. Closes #3
This commit is contained in:
s1d3sw1ped_bot
@@ -34,7 +34,7 @@ Flow: User → Client:8080,2222 → Encrypted Tunnel (Port 9000) → Server:80,2
|
||||
**Server Configuration** (`server.yaml`):
|
||||
```yaml
|
||||
instance_id: teleport-server-01
|
||||
listen_address: :9000
|
||||
listen_address: 127.0.0.1:9000 # loopback; use 0.0.0.0:9000 to publish
|
||||
remote_address: ""
|
||||
ports:
|
||||
- "tcp://192.168.1.100:80"
|
||||
@@ -50,6 +50,7 @@ write_timeout: 30s
|
||||
instance_id: teleport-client-01
|
||||
listen_address: ""
|
||||
remote_address: server.example.com:9000
|
||||
bind_address: 127.0.0.1
|
||||
ports:
|
||||
- "tcp://80:8080"
|
||||
- "tcp://22:2222"
|
||||
@@ -59,9 +60,11 @@ read_timeout: 30s
|
||||
write_timeout: 30s
|
||||
```
|
||||
|
||||
**Usage**:
|
||||
- User connects to `localhost:8080` → Traffic flows through encrypted tunnel on port 9000 → Server forwards to remote web server at `192.168.1.100:80`
|
||||
- User connects to `localhost:2222` → Traffic flows through same encrypted tunnel on port 9000 → Server forwards to remote SSH server at `192.168.1.200:22`
|
||||
**Usage**:
|
||||
- User connects to `127.0.0.1:8080` (client local listener, loopback by default) → Traffic flows through encrypted tunnel on `127.0.0.1:9000` → Server forwards to remote web server at `192.168.1.100:80`
|
||||
- User connects to `127.0.0.1:2222` → Traffic flows through the same encrypted tunnel → Server forwards to remote SSH server at `192.168.1.200:22`
|
||||
|
||||
Local client ports bind `127.0.0.1` unless you set `bind_address: 0.0.0.0` or a per-rule host such as `"tcp://22:0.0.0.0:2222"`. Server `listen_address: 127.0.0.1:9000` is loopback-only; `0.0.0.0:9000` (or `:9000`) publishes the tunnel on all interfaces and must be explicit.
|
||||
|
||||
Both services share the same encrypted tunnel connection!
|
||||
|
||||
@@ -116,7 +119,7 @@ Generate example configuration files:
|
||||
|
||||
```yaml
|
||||
instance_id: teleport-server-01
|
||||
listen_address: :8080
|
||||
listen_address: 127.0.0.1:8080 # use 0.0.0.0:8080 to accept remote clients
|
||||
remote_address: ""
|
||||
ports:
|
||||
- "tcp://localhost:80"
|
||||
@@ -143,6 +146,7 @@ dns_server:
|
||||
instance_id: teleport-client-01
|
||||
listen_address: ""
|
||||
remote_address: localhost:8080
|
||||
bind_address: 127.0.0.1
|
||||
ports:
|
||||
- "tcp://80:8080"
|
||||
encryption_key: your-secure-encryption-key-change-this-to-something-random
|
||||
@@ -169,16 +173,19 @@ dns_server:
|
||||
## Configuration Fields
|
||||
|
||||
- `instance_id`: Unique identifier for this teleport instance
|
||||
- `listen_address`: Address to listen on (server mode) - format: `host:port`
|
||||
- `listen_address`: Address the **server** binds for the encrypted tunnel (`host:port`). Examples use `127.0.0.1:9000`. Use `0.0.0.0:9000` or `:9000` only when you intend to publish the server on all interfaces.
|
||||
- `remote_address`: Address of remote teleport server (client mode) - format: `host:port`
|
||||
- `bind_address`: Host for **client** local TCP/UDP listeners (default: `127.0.0.1`). Set to `0.0.0.0` to accept connections from other machines. Publishing on all interfaces is never implicit.
|
||||
- `ports`: Array of port forwarding rules in URL-style format
|
||||
- **Server format**: `protocol://target:targetport` - forwards to remote target
|
||||
- **Client format**: `protocol://targetport:localport` - forwards to teleport server's targetport, listens on localport
|
||||
- **Client format**: `protocol://targetport:localport` - forwards to teleport server's targetport, listens on `bind_address:localport` (default `127.0.0.1`)
|
||||
- **Client with bind**: `protocol://targetport:bindhost:localport` - per-rule listen host, e.g. `"tcp://22:0.0.0.0:2222"`
|
||||
- Examples:
|
||||
- `"tcp://localhost:80"` (server) - listen on port 80, forward to localhost:80
|
||||
- `"tcp://server-a:22"` (server) - listen on port 22, forward to server-a:22
|
||||
- `"tcp://80:8080"` (client) - listen on port 8080, forward to teleport server's port 80
|
||||
- `"udp://53:5353"` (client) - listen on port 5353, forward to teleport server's port 53
|
||||
- `"tcp://localhost:80"` (server) - forward to localhost:80
|
||||
- `"tcp://server-a:22"` (server) - forward to server-a:22
|
||||
- `"tcp://80:8080"` (client) - listen on `127.0.0.1:8080`, forward to teleport server's port 80
|
||||
- `"tcp://22:0.0.0.0:2222"` (client) - listen on all interfaces port 2222
|
||||
- `"udp://53:5353"` (client) - listen on `127.0.0.1:5353`, forward to teleport server's port 53
|
||||
- `encryption_key`: Shared secret key for encryption (must be the same on both sides)
|
||||
- `keep_alive`: Enable TCP keep-alive
|
||||
- `read_timeout`: Read timeout duration
|
||||
@@ -192,6 +199,7 @@ dns_server:
|
||||
- `dns_server`: DNS server configuration
|
||||
- `enabled`: Enable built-in DNS server
|
||||
- `listen_port`: Port for DNS server to listen on
|
||||
- `bind_address`: DNS listen host (default: `127.0.0.1`). Set to `0.0.0.0` to serve DNS on all interfaces; the default is not an open recursive forwarder on every interface.
|
||||
- `backup_server`: Backup DNS server for fallback (e.g., "8.8.8.8:53")
|
||||
- `custom_records`: Array of custom DNS records
|
||||
- `name`: Domain name (e.g., "example.com")
|
||||
@@ -278,14 +286,15 @@ Teleport uses URL-style port mapping format for cleaner configuration:
|
||||
|
||||
```yaml
|
||||
ports:
|
||||
- "tcp://80:8080" # Listen on port 8080, forward to teleport server's port 80
|
||||
- "udp://53:5353" # Listen on port 5353, forward to teleport server's port 53
|
||||
- "tcp://22:2222" # Listen on port 2222, forward to teleport server's port 22
|
||||
- "tcp://80:8080" # Listen on 127.0.0.1:8080, forward to teleport server's port 80
|
||||
- "udp://53:5353" # Listen on 127.0.0.1:5353, forward to teleport server's port 53
|
||||
- "tcp://22:0.0.0.0:2222" # Explicit all-interfaces bind
|
||||
```
|
||||
|
||||
**Format**:
|
||||
- **Server**: `"protocol://target:targetport"` - listen on targetport, forward to target:targetport
|
||||
- **Client**: `"protocol://targetport:localport"` - listen on localport, forward to teleport server's targetport
|
||||
**Format**:
|
||||
- **Server**: `"protocol://target:targetport"` - forward to target:targetport
|
||||
- **Client**: `"protocol://targetport:localport"` - listen on `127.0.0.1:localport` (or `bind_address`), forward to teleport server's targetport
|
||||
- **Client with bind**: `"protocol://targetport:bindhost:localport"` - listen on bindhost:localport
|
||||
|
||||
**Examples:**
|
||||
```yaml
|
||||
@@ -295,11 +304,12 @@ ports:
|
||||
- "tcp://server-a:22" # Listen on port 22, forward to server-a:22
|
||||
- "udp://dns-server:53" # Listen on port 53, forward to dns-server:53
|
||||
|
||||
# Client configurations
|
||||
# Client configurations
|
||||
ports:
|
||||
- "tcp://80:8080" # Listen on port 8080, forward to teleport server's port 80
|
||||
- "tcp://22:2222" # Listen on port 2222, forward to teleport server's port 22
|
||||
- "udp://53:5353" # Listen on port 5353, forward to teleport server's port 53
|
||||
- "tcp://80:8080" # Listen on 127.0.0.1:8080, forward to teleport server's port 80
|
||||
- "tcp://22:2222" # Listen on 127.0.0.1:2222, forward to teleport server's port 22
|
||||
- "tcp://22:0.0.0.0:2222" # Listen on all interfaces (explicit)
|
||||
- "udp://53:5353" # Listen on 127.0.0.1:5353, forward to teleport server's port 53
|
||||
```
|
||||
|
||||
**Example: Remote SSH Access**
|
||||
@@ -308,10 +318,10 @@ To access SSH on Server A through teleport server on Server B:
|
||||
**Server B configuration:**
|
||||
```yaml
|
||||
instance_id: teleport-server-b
|
||||
listen_address: :8080
|
||||
listen_address: 127.0.0.1:8080
|
||||
remote_address: ""
|
||||
ports:
|
||||
- "tcp://server-a:22" # Listen on port 22, forward to server-a:22
|
||||
- "tcp://server-a:22" # Forward to server-a:22
|
||||
encryption_key: your-shared-key
|
||||
```
|
||||
|
||||
@@ -320,8 +330,9 @@ encryption_key: your-shared-key
|
||||
instance_id: teleport-client-c
|
||||
listen_address: ""
|
||||
remote_address: server-b:8080
|
||||
bind_address: 127.0.0.1
|
||||
ports:
|
||||
- "tcp://22:2222" # Listen on local port 2222, forward to teleport server's port 22
|
||||
- "tcp://22:2222" # Listen on 127.0.0.1:2222, forward to teleport server's port 22
|
||||
encryption_key: your-shared-key
|
||||
```
|
||||
|
||||
@@ -345,7 +356,7 @@ The program validates your configuration and will show clear error messages if:
|
||||
|
||||
**Valid Server Configuration:**
|
||||
```yaml
|
||||
listen_address: :8080
|
||||
listen_address: 127.0.0.1:8080
|
||||
remote_address: ""
|
||||
ports:
|
||||
- "tcp://localhost:22"
|
||||
@@ -355,6 +366,7 @@ ports:
|
||||
```yaml
|
||||
listen_address: ""
|
||||
remote_address: server:8080
|
||||
bind_address: 127.0.0.1
|
||||
ports:
|
||||
- "tcp://22:2222"
|
||||
```
|
||||
@@ -369,6 +381,7 @@ ports:
|
||||
- Encryption keys are validated for entropy and strength
|
||||
- Logging includes automatic sanitization of sensitive data
|
||||
- Rate limiting prevents abuse and DoS attacks
|
||||
- Client local listeners and the built-in DNS server bind `127.0.0.1` by default so LAN/internet hosts cannot use your tunnel unless you set `bind_address` / a per-rule host to `0.0.0.0`
|
||||
|
||||
## Example Use Cases
|
||||
|
||||
@@ -394,7 +407,7 @@ ports:
|
||||
- Generate: `./teleport -generate-config -config teleport-client.yaml`
|
||||
- Edit the configuration file with local ports and remote server address
|
||||
- Run: `./teleport -config teleport-client.yaml`
|
||||
- Connect to `localhost:local_port` to access the remote service
|
||||
- Connect to `127.0.0.1:local_port` (loopback by default) to access the remote service
|
||||
|
||||
## Multi-Client Support
|
||||
|
||||
@@ -428,6 +441,7 @@ The built-in DNS server provides:
|
||||
dns_server:
|
||||
enabled: true
|
||||
listen_port: 5353
|
||||
bind_address: 127.0.0.1
|
||||
backup_server: 8.8.8.8:53
|
||||
custom_records:
|
||||
- name: api.local
|
||||
@@ -510,8 +524,8 @@ Teleport includes sophisticated logging with:
|
||||
|
||||
- The encryption key must be identical on both server and client
|
||||
- Use `./teleport --generate-key` to create a secure random encryption key
|
||||
- The server listens on the specified `listen_address` for incoming connections
|
||||
- The client connects to the remote server and forwards local connections
|
||||
- The server listens on the specified `listen_address` for incoming tunnel connections (examples bind loopback; `0.0.0.0` must be explicit)
|
||||
- The client connects to the remote server and forwards local connections from `bind_address` (default `127.0.0.1`)
|
||||
- All port forwarding is bidirectional
|
||||
- Port format uses URL-style conventions: `"protocol://target:port"`
|
||||
- Configuration files use YAML format for better readability
|
||||
|
||||
Reference in New Issue
Block a user