Reverse SSH (or other tunnel/VPN)

[Net Llama!]

On Tue, 21 Dec 2004, Michael Hipp wrote:
> Matthew Carpenter wrote:
>
> > Yes.
> >
> > If you simply want a tunnel to a port on the remote system, and you want
> > it to be originated from that system:
> >
> > remote# ssh -R <RMTPORT>:<lclhostname>:<lclport> <REMOTEHOST> vi
> > </dev/null >/dev/null 2>&1 &
> >
> > This sets the <REMOTEHOST> to listen on <RMTPORT> and tunnels the
> > connection the <lclhostname> on port <lclport>
> >
> > All these are as the executing system sees things.  So if this is run on
> > a client system behind a NAT, <lclhostname> could be "localhost" or it's
> > domain name, even if the other system can't actually "get back".
> >
> > I do this in reverse for pulling and sending mail from my home-network.
>
> Matthew, you lost me on this ...
>
> (Or I'm just too dumb to get it.)
>
> Do I understand you issue a command like the above on the *host*
> computer (behind NAT) and something shows up on the *client* that allows
> someone sitting in front of the client to get a shell from the host?
>
> What is the purpose of the 'vi' command and all the redirects?
>
> Sorry. I've done lots of these kinds of port tunnels from client-host
> but never considered how such might be done host-client.

I'm not sure why vi was in that command either, but here's what will work
for what you want to do.

On the box behind the NAT, (we'll call it localhost) issue this command.
Your random remote, internet facing box will be called foo.bar.com:
ssh -R 3500:localhost:22 foo.bar.com

The above command assumes that you have the same username on both boxes.
If not, adjust to include a '-l' option for foo.bar.com.  Once you issue
that command and are ssh'd onto foo.bar.com, issue this command:

ssh -p3500 localhost

The above command assumes that you have the same username on both boxes.
If not, adjust to include a '-l' option for your NAT'd box (localhost).
Once you do that, you'll be ssh'd onto the NAT'd box (localhost).

I usually run the first command inside a screen session so that its out of
the way, and semi-transparently maintains the connection.  Now as long as
you don't log out from the first command, you can ssh into foo.bar.com and
issue that 2nd command and get into your NAT'd (localhost) box from
anywhere.


-- 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Lonni J Friedman                                netllama at linux-sxs.org
Linux Step-by-step & TyGeMo                  http://netllama.ipfox.com