wiki.nth.ro

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
===== Reverse SSH tunneling =====

==== Problem ====
Say we are working on a server product which we want to expose to the internet but our current networking set-up does not grant us an external IP address.

A reification of the above is the following: benishor went to Cluj and decided to work from the hotel. He started up the server application that he was working on in a virtual machine and then wanted to access it from his 3G-enabled mobile phone. Clearly this was not going to work. What to do? What to do?

==== Prerequisites =====
You need an external VPS and SSH access to it.

==== Solution ====
We can make use of ssh's ability to act as a reverse proxy tunneling product.

''ssh -R *:<vps_listening_port>:<host_that_will_process_request>:<port_on_processing_host> user@vps''

As a concrete example, this is what worked for benishor

''ssh -N -T -R *:8080:192.168.50.4:8081 benny@demoscene.ro''

The above command roughly translates to: __I want sshd on demoscene.ro to listen on all interfaces on port 8080 and route all traffic that it receives to 192.168.50.4:8081 as seen from my local machine__.

The extra flags have the following meaning:

-T disables pseudo-tty allocation, which is appropriate because you're not trying to create an interactive shell

-N says that you want an SSH connection, but you don't actually want to run any remote commands. If all you're creating is a tunnel, then including this option saves resources.


Here's a lovely image as drawn by **shd**, depicting the command syntax:

{{http://i.imgur.com/Ccex5Iu.png}}

=== Gotchas ===
''sshd_config'' must be edited to contain ''GatewayPorts yes'' in order for sshd to be able to listen on interfaces other than loopback. Depending on your distribution, this entry may or may be not enabled by default.

Sometimes the connection might stall or drop. This is a great opportunity to try [[http://www.harding.motd.ca/autossh/|autossh]]
{{tag>reverse ssh tunnel nix}}