Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an interesting question regarding SSH. I have a machine at school that I'd like to be able to access from elsewhere. It's behind a firewall/NAT, so I can't get at it directly. I have a leased web server that I can SSH into from anywhere. I was wondering if I could do some voodoo with port forwarding to get to my machine at school via the web server. I think this comes down to whether you can do SSH "backwards," which may or may not be possible.

Machine A can access Machine B
Machine C can also access Machine B
How can Machine A access Machine C?

share|improve this question
up vote 5 down vote accepted

As to "backward" SSH there's Reverse Remote Shell that I've been using for a while in a similar situation.

But here, some things should be clarified first:

  1. What kind of access do you need? Are we talking about SSH only or you meant something else?
  2. What's about this web server (B)? Can it access the destination (C) directly without problems (which is not possible from A)? Or is it only a problem of unknown/dynamic IP of the source machine (A)?

I presume that in a standard situation you're able to initiate outgoing connections from C without restrictions, and all new inbound traffic is filtered, right?


In that case you could use Reverse Remote Shell to connect from C (school) to B (SSH account). Then logging in from A (home) to B over SSH you grab the reverse console access to C. Plus side of this is it should work on almost any configuration.

Major drawbacks:

  1. It's SSH only plus things you can do when you have local access to C.
  2. You implicitly trust B (that your session won't be stolen).

This is a bit cumbersome. It would be much easier to use SSH port forwarding for this, but that is sometimes blocked by universities/schools (at least from my experience). Please see if you can use it in your situation. Then an easier and more elegant solution should be possible.

share|improve this answer
If I can get SSH, I can presumably tunnel anything else I need. Both A and C don't have externally accessible IP addresses, otherwise this'd be a good deal easier. – stillinbeta Apr 23 '10 at 20:46

Yes, you can do port forwarding using SSH to get access to your machine at school. What you'll have to do is:

  1. From the machine at school, you issue the following command:

    ssh -R port_on_server:localhost:local_port user@server

  2. From the machine at home you do:

    ssh -L local_port:locahost:port_on_server user@server

Now, you can access your local_port at your home machine and will be forwarded to local_port at the machine at school. For example, if local_port is 80, you would be able to type http://localhost/ on your web browser and access the web server running at the machine at school.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .