5

Is there a way to establish a SSH connection over UDP?

I'm running behind a "filter all inbound TCP traffic" firewall so I cannot utilize a SSH tunnel properly.

I have set up over at my brothers that I have control over (SSH). I want to connect to it from behind the firewall to somehow port forward to the MySQL and Redis databases I have on my servers behind the firewall.

5
  • 6
    OpenVPN typically runs over UDP. If you can establish an OpenVPN connection, you could ssh over that, although then you should also be able to directly access your MySQL and REDIS without using ssh as another transport tunnel layer. Sep 24, 2016 at 15:11
  • Assuming here that you have confirmed UDP is not firewalled.
    – nik
    Sep 24, 2016 at 20:01
  • What exactly is, from your perspective, behind the firewall? You? Or the SSH server host? Why do you think it wouldn't block UDP? Is the firewall a NAT router?
    – Daniel B
    Sep 24, 2016 at 21:03
  • Just connecting to a VPN does not work as I'm sure you need to port forward something to the VPN network and back. UDP comes back as open by nmap and I can use OpenVPN over UDP by specifying any random UDP port range. From my perspective, I am behind the firewall and so is the server I want to port forward to. I'm not really sure what type of firewall it is, but I know there are 3 routes from the external point to my internal router, so it could be anything really. I do know for sure UDP works though. Sep 25, 2016 at 0:36
  • 1
    @B.Garrison: "Just connecting to a VPN does not work as I'm sure you need to port forward something". No, if you have a VPN connection between your local network and the remote network, there is no need for any port-forwarding. Sep 28, 2016 at 11:35

2 Answers 2

2

The Mobile Shell (Mosh).

Prerequisites of the server

The major drawback of mosh is that it requires the server to fulfill additional prerequisites which are not needed by ssh itself. Due to its design, mosh needs the server to allow direct connections via UDP. Servers not fulfilling these prerequisites cannot be used by mosh. Examples of such systems include servers behind firewalls which restrict connections to the ssh-port via TCP. Also problematic are servers which are only indirectly reachable. The latter is usually accommodated by ssh via the 'ProxyCommand' option, but this is not supported by mosh.

One port per connection.

By default, the server tries to allocate the first free UDP port in the range 60000-61000, per connection. This dynamic port allocation is considered an extra burden and risk for firewall maintenance. A significant part of the firewall-filtering happens through connection tracking, so called stateful filtering, this is based on the SYN/ACK flags in TCP segments, UDP packets don't have such flags.

Other things.

  • No IPv6 roaming support.
  • Scrollback is not supported in the current release of mosh, and when using it in a terminal emulator with scrollbars they disappear.
  • Lack of SSH-Agent forwarding.
  • Lack of X-11 forwarding.

For more see SSH vs Mosh.

3
  • 1
    Mosh would solve SSH access, but I still need my databases forwarded and some other services too. Thanks for the suggestion though! Sep 25, 2016 at 0:39
  • 2
    Although mosh is cool, it requires both tcp and udp. It first connects via regular ssh, then drops to udp.
    – Ivan
    Mar 13, 2018 at 15:51
  • Even for a simple interactive remote shell, Mosh has the drawback that it does not support the alternate screen, partly due to the fact that it emulates a terminal.
    – vinc17
    Nov 29, 2021 at 23:43
0

Check out hscp, which isn't exactly what you're looking for but may have some of the features you want. UDP-based SCP, plus I think some SSH basics. https://ccportal.ims.ac.jp/en/software/hscp

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .