SSH access to office host behind NAT router

Question

I would like to access the ssh port of my office linux host from home. Unfortunately the host is located behind a NAT router. So, the IP address is not publicly available. There is however access to another internet host (Server) which is unfortunately only non-root access. After a while of searching I do not find a suitable solution.

Following setup:

• Office PC (linux, root access) behind NAT (IP not public) but full Internet access.
• Server PC (linux, no root access) static and public IP and full Internet access.
• Home PC (linux, root access) behind NAT (IP not public) but full Internet access.

Possible connections: Office PC --> Server <-- Home PC

Not possible: Office PC <-X- Server -X-> Home PC

Neither the Home PC, nor the Server can initiate access to the Office PC. But both the Office PC and the Home PC can initiate connections to the Server.

Reverse SSH tunnel not possible: I tried a method called reverse ssh-tunnel. Unfortunately this requires GatewayPorts on Server set to "yes" in /etc/ssh/sshd_config, where I have no root access.

In principle it should be possible:

0) On the Server I start a userspace program which listens on 2 ports (1 incoming, 1 outgoing)

1) On my office PC I run a another program which keeps a TCP connection open to the outgoing port on the server.

2) From home I connect to Server's incoming port.

There should be a standard solution for this out there.

What is the quickest and cleanest solution to solve this?

Frank

Answer 1

youatwork@officepc$ autossh -R 12345:localhost:22 notroot@serverpc

Later:

you@homepc$ autossh -L 23456:localhost:12345 notroot@serverpc

you@homepc$ ssh youatwork@localhost -p 23456

What you could do is this: in step 1 forward a remote port from the office PC to the server (12345 is used as an example, any port >1024 should do). Now connecting to 12345 on the server should connect you to port 22 on officepc.

In step 2, forward the port 23456 from your home machine to 12345 on the server (whence it gets forwarded to officepc:22, as set up in step 1)

In step 3, you connect to the local port 23456 with your office PC login. This is forwarded by step 2 to port 12345 on your server, and by step 1 to your office PC.

Note that I'm using autossh for the forwardings, as it's a ssh wrapper which automatically reconnects the tunnel should it be disconnected; however normal ssh would work as well, as long as the connection doesn't drop.

There is a possible vulnerability: anyone who can connect to localhost:12345 on serverpc can now connect to officepc:22, and either a) try to hack into it or b) by hogging the tunnel, deny you the possibility to use it (DoS).

Edit: I have verified this with the same config, and it works. GatewayPorts no only affects the ports that are open to the world at large, not local tunnels. This is what the forwarded ports are:

homepc:
  outgoing ssh to serverpc:22
  listening localhost:23456 forwarded through ssh tunnel
serverpc:
  listening ssh at *:22
  incoming localhost ssh tunnel (from homepc) forwarded to localhost:12345
  listening localhost ssh tunnel (from officepc) forwarded from localhost:12345
officepc:
  outgoing ssh to serverpc:22
  incoming localhost through ssh tunnel (from serverpc) forwarded to localhost:22

So, as far as the network stack is concerned, it's all local traffic on the respective loopback interfaces (plus ssh connections to serverpc); therefore, GatewayPorts is not checked at all.

There is, however, the directive AllowTcpForwarding: if that is no, this setup will fail as no forwarding is allowed at all, not even across the loopback interface.

Answer 2

If you can ssh to the internal server from home and from the internal server to your office Linux machine, then from home you can use the ssh ProxyCommand to bounce silently through the server to the internal machine via nc (netcat)

# ~/.ssh/config on your home machine:
Host internalpc 
   ForwardAgent yes 
   ProxyCommand ssh user@server.example.com exec nc internal.pc.example.com %p

Then you just ssh user@internalpc and you are silently forwarded through the server machine, no opening of ports or tunnels required on either end.

Answer 3

To me , it sounds like, instead of a SSH tunnel, you should try a VPN: the kind that works by using a server on the outside to proxy through, such as Hamachi . There are other free softwares like this one, but Hamachi is my fav.

Answer 4

Piskvor's solution works and is nice. However, it keeps terminals dangling open with login shells hanging. Not very cool.

I've always used this little script I wrote to connect to a server and keep it connected by running it in cron:

#!/bin/bash
TARGET_HOST=${1:-myserver.example.com}
TARGET_PORT=${2:-7777}
TUNNEL_PORT=${3:-22}
T_USER="odin"

#Check that we have an active connection to the remote system
ACTIVE_PROCESS=`ps -ef | \
    grep "ssh $TARGET_HOST -l $T_USER -R $TARGET_PORT:127.0.0.1:$TUNNEL_PORT" | \
    grep -v grep | \
    wc -l`
if [ $ACTIVE_PROCESS -lt 1 ]; then
    echo "`date` : establishing connection to $TARGET_HOST on port $TARGET_PORT"
    screen -m -d ssh $TARGET_HOST -l $T_USER -R $TARGET_PORT:127.0.0.1:$TUNNEL_PORT > /dev/null
fi

I bet we could fix Piskvor's solution using the more elegant autossh alongside maybe a detached screen or use the -NT ssh arguments to just keep the connection up in the background.