VPN USB Token Redirection

[MarcosAG02]

Colleagues, good afternoon!

I'm trying to redirect a USB token from a Windows computer (with version 3.0.0 installed) to a Linux workstation, but through a VPN tunnel.

I list the USBs through PowerShell, I share the token and on the Linux station, I use the command to connect to the shared Token using the ip that my Windows machine acquired when connecting to the VPN.

We use CheckPoint VPN and a port 3240 release rule has already been added to our Firewall.

But I still get the error "ip:3240: System error" when trying to list the Windows machine's USBs from the remote Linux.

Commands I used on Linux:

"sudo usbip list -r windows_server_ip";

Then I tried connecting to the shared token, even without listing:
"sudo usbip attach -r windows_server_ip"
I got the error: "usbip:error:tcp connect"

I had created rules on the local firewall, but I saw that the installer already creates these rules, so I removed the rules, along with uninstalling USB/ip win.
After that, I did the installation again using: "winget install --interactive --exact dorssel.usbipd-win"

The error keeps occurring.

Can you help me identifying what I did wrong?

I saw that there are similar discussions, but all using WSL. I haven't seen any cases like mine that use a VPN connection.

Thanks in advance for everyone's help and attention.

[dorssel]

I use something similar to this setup all the time:

My Windows machine is "locked down", such that it cannot receive incoming connections (and we need incoming remote connections from the other machine). So, I SSH into the remote machine (this is allowed), with a reverse tunnel.

From the Windows host:

ssh.exe [email protected] -R 192.168.x.y:3240:127.0.0.1:3240

192.168.x.y is the IP address of the remote Linux machine that will be the guest of the USBIP device.
This allows me to do usbip attach -r 192.168.x.y -b 1-1 on the remote Linux machine. It queries its own IP address, but that is really redirected (tunneled) via SSH to the Windows machine. This in turn looks to the Windows machine like an incoming connection from "localhost", which is allowed.

Usually, such "reverse tunnels to localhost" bypass all firewalls.

[MarcosAG02]

@dorssel, Thanks for the answer.

I did the tests here and guess what?

Our firewall (Firewall VPN Access) also blocks port 22...

hahahahaha

I'm laughing so I don't cry...

[MarcosAG02]

@dorssel Good afternoon, how are you?

I requested the unblocking of ports 3240 and 22 (SSH) on the Firewall here at work and even so I still have the timeout error.

Let me see if I understand your solution:

Do you SSH connect from Windows (where the usb token is connected) to Windows itself?

My environment is set up like this:

Windows at home, connected to VPN. Assumed ip 10.41.12.34 through VPN connection (That ip is from corporate network, assigned to my Windows machine after authentication on VPN).

Linux at work, with ip 192.168.32.56, being accessed by RDP after VPN authentication, which is where I want the Token to be recognized.

So I must do in Windows PowerShell:
"ssh.exe [email protected] -R 10.41.12.34:3240:127.0.0.1:3240"?

Or would I have to, on the remote Linux station, run the command:

"ssh [email protected] -R 192.168.32.56:3240:127.0.0.1:3240"?

[dorssel]

If your Windows host is accepting incoming connections on port 3240 and the Linux remote machine has a direct route to the Windows host (which I am unsure about, since you mention both 10.41.12.34 and 192.168.32.xxx as VPN addresses), then you should just

sudo usbip attach -b <busid> -r <ip-address-for-Windows-host-reachable-from-Linux>

Else, you need to reverse tunnel by SSH from Windows to Linux (i.e., run ssh on Windows):

ssh.exe user@<IP-address-of-Linux-reachable-from-Windows> -R <IP-address-of-Linux-reachable-from-Windows>:127.0.0.1:3240"

and subsequently on Linux:

sudo usbip attach -b <busid> -r <IP-address-of-Linux-reachable-from-Windows>