Ssh reverse tunnel

on

 

Make a ssh connection to a PC behind a router / NAT


 

When do you need this solution?

PC A has a ssh server running. You want to connect to it from PC B but PC A is sitting behind a router/NAT, there is no public IP and a fixed local IP for PC A.

For PC B, it is also sitting behind a router.

Steps

  1. Create a proxy with a ssh server. It should be public accessible. For example [2]
  2. Set up a pair of ssh tunnels with the following commands
## on proxy ##
# set up a normal ssh server on the proxy

## on pc a -- this is the ssh server behind the router/NAT that we want to connect to##
$ ssh -R<proxy_ip_002>:<proxy_idle_port>:<pc_a_ip>:<pc_a_ssh_port> <proxy_user_name>@<proxy_ip_001> -p <proxy_ssh_port> -i <proxy_user_private_key>

## on pc b ##
$ ssh -L<pc_b_ip>:<pc_b_idle_port>:<proxy_ip_002>:<proxy_idle_port> <proxy_user_name>@<proxy_ip_001> -p <proxy_ssh_port> -i <proxy_user_private_key> 
$ ssh <pc_a_user_name>@localhost -p <pc_b_idle_port> -X

## example -- ssh ##
## on pc a ##
$ ssh -R127.0.0.1:5222:localhost:22 proxy_user@12.54.33.12 -p 22 -i .ssh/proxy_user_pk

## on pc b ##
$ ssh -Llocalhost:6222:127.0.0.1:5222 proxy_user@12.54.33.12 -p 22 -i .ssh/proxy_user_pk
$ ssh pc_a_user@localhost -p 6222 -i pc_a_user_pk -X

Note:

  • ssh -R127.0.0.1:xxxx
    • The reason we need to use 127.0.0.1 but not 12.54.33.12 is that this IP address is searched by the proxy itself, so normally there is no record of 12.54.33.12 on the proxy machine. As a result, you should use 127.0.0.1 or localhost in this case.
    • If there is multiple IP on the proxy machine, you can use other IP also.

Advance: Make the ssh tunnel on PC A startup 👀

Since the proxy is public accessible, PC A can make the ssh tunnel automatically.

Steps:

  1. Finish the proxy setup
  2. Add service on PC A. Learn from [4] [5] [6]
$ cat /etc/systemd/system/ssh_tunnel_001.service

[Unit]
Description = Reverse ssh tunnel
After =  network-online.target 
#Requires

[Service]
User = root
Environment=AUTOSSH_GATETIME=0
ExecStart = /usr/bin/autossh -M 0 -q -N -o "PubKeyAuthentication=yes" -o "PasswordAuthentication=no" -o "ExitOnForwardFailure=yes" -o "ServerAliveInterval 30" -o "ServerAliveCountMax 3"  -i /home/[LOCAL USER]/.ssh/id_rsa -R [REMOTE PORT]:localhost:22 -l [REMOTE LOGIN] [REMOTE HOST]
ExecStop= /usr/bin/killall autossh

[Install]
WantedBy = multi-user.target

$ sudo systemctl daemon-reload
$ sudo service ssh_tunnel_001 restart
$ service ssh_tunnel_001 status

Additional: remove service

Learn from [7]

$ systemctl stop [servicename]
$ systemctl disable [servicename]
$ rm /etc/systemd/system/[servicename]
$ rm /etc/systemd/system/[servicename] # and symlinks that might be related
$ rm /usr/lib/systemd/system/[servicename] 
$ rm /usr/lib/systemd/system/[servicename] # and symlinks that might be related
$ systemctl daemon-reload
$ systemctl reset-failed

 

Reference

[1] X. (n.d.). Pricing / xShellz. xShellz. https://www.xshellz.com/pricing

[2] ssh(1) - Linux manual page. (n.d.). https://man7.org/linux/man-pages/man1/ssh.1.html

[3] autossh: monitor and restart ssh sessions | autossh Commands | Man Pages | ManKier. (n.d.). https://www.mankier.com/1/autossh

[4] A. (n.d.). GitHub - axthosarouris/reverse-ssh-tunnel. GitHub. https://github.com/axthosarouris/reverse-ssh-tunnel

[5] Rendek, L. (2020, May 12). How to start service on boot on Ubuntu 20.04. Linux Tutorials - Learn Linux Configuration. https://linuxconfig.org/how-to-start-service-on-boot-on-ubuntu-20-04

[6] L. (2021, November 25). Enable or Create a Service in Ubuntu 20.04 LTS - LinuxStoney. LinuxStoney. https://linuxstoney.com/enable-or-create-a-service-in-ubuntu-20-04-lts/

[7] How to remove systemd services. (n.d.). Super User. https://superuser.com/a/936976


Comments

Post a Comment