Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 0 down vote favorite

Machine A is behind a firewall. I have physical access to it, but I want to log into it remotely, and I do not have access to the firewall settings.

Machine B is remote, and not behind any firewall. (It's my linode)

Machine C is the mobile device I'm going to attempt to ssh into A from.

Is there an ssh command that I can run from machine A that connects to machine B and stays open, that will allow me to log into A from C, via B?

From the manual I'd guess it would be to run the follwing on A

ssh -R *:9999:localhost:22 me@B

and then run this on C

ssh me@B -p 9999

but the previous command reports "Connection refused."

share|improve this question
1  
Is your mobile device a phone or a laptop? What kind of phone? If supported, you could install Hamachi which is a zero config vpn server on Machine A without needing to open up any ports on your firewall. This would allow you to SSH into Machine A without even needing Machine B through Machine C. Hamachi does support ARM, Linux, Windows, Windows Mobile, etc. If on an Android device, you would need to have root access to install the necessary dependencies. – kobaltz Mar 7 '12 at 19:03
It's a laptop. I was hoping to avoid setting up a VPN. – Nathan Mar 8 '12 at 0:32
1  
The nice thing about Hamachi though is that you do not need to open up any ports on your firewall. Everything is initiated via an outgoing request. Much more secure than the option of having to open up ports on your firewall. – kobaltz Mar 8 '12 at 0:56

1 Answer

up vote 1 down vote

To be able to access Machine A (behind firewall) from Machine C via intermediate Machine B (outside firewall), do this:

On Machine A: 

ssh -2 -N -l [acct on B] -g -R 4001:localhost:22 MachineB

'-g' may or may not be required. That is what I use.
You can pick any port besides '4001'.

Then on Machine B: 

ssh -p4001 -g -L 9999:machineA:22 localhost

Note that 'machineA' could also be '127.0.0.1'. Not 100% sure - experiment.
'-g' makes port 9999 also available to other machines external to Machine B.
Omitting '-g' makes port 9999 available only to other processes on Machine B.

Then on Machine C: 

ssh -p9999 me@MachineB

Voila!

You could also access another machine, D, on A's network from C. Do this on MachineB:

ssh -p4001 -g -L 9999:[some machine on MachineA's network]:[some port] localhost

This allows you to access a port on some other machine on MachineA's network.

So, if there exists a machine D, also behind the firewall on the same network that sits beside Machine A, you can access it from Machine C as if you were sitting at Machine A.

For example, if Machine D is a Windows Server box and you want to use Remote Desktop from Machine C, which is also a Windows Box, to Machine D, do this:

Machine A: 

ssh -2 -N -l [acct on B] -g -R 4001:localhost:22 MachineB

(this is same)

Machine B: 

ssh -p4001 -g -L 9999:machineD:3389 localhost

Machine C: Fire up RDP client and connect to MachineB:9999

BAM! You're connected to the Windows Server Box (Machine D) from Machine C.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.