6

I have a remote computer on a 3G PPP connection. I can't connect to this computer via the Internet as I believe the PPP IP pool uses NAT to connect to the Internet (I get given a 10.x.x.x address when I connect)

So I get the remote computer to create a SSH connection to a server on the Internet. I can then tunnel down this connection from the server and get a shell on the remote computer. Great.

I want to be able to access the Web interface of a camera on the remote network. So I create a second SSH tunnel that redirects traffic to the address of the camera, ie: ssh -R 9000::

From my Internet host this works, I get the web page: wget 127.0.0.1:9000 Great

Now I need this to work from my client PC so:

Client PC --> Internet server --tunnel--> Remote computer --> IP camera

So essentially I need to make my reverse SSH tunnel available over the network.

I assumed if I just used iptables to forward incoming traffic on a certain port on my Internet server to 127.0.0.1:9000 that would work but I haven't been able to make it work after hours of playing with iptables, NAT etc.

Should this work?

Improve this question
6
  • did youu ensure you are listening on all interfaces on port 9000?
    – daya
    Dec 23, 2012 at 23:21
  • Perhaps easier to avoid terms like local and remote particularly when it is unclear. The 3G computer is the one you are calling "remote", it is behind NAT or a NAT like thing. You SSH from there to another computer which runs an SSH server, for the Internet. That's ssh -D and opens a port on the 3G computer to access the internet. A device on the 3G side has a camera or is a camera, So you use ssh -R for that one from the 3G. OK I think I got that
    – barlop
    Dec 24, 2012 at 0:42
  • Is that above comment of mine correct? I am not sure off hand what the default is, but when you do the ssh -R command, often people do PORT:IP:PORT but you can do IP:PORT:IP:PORT where the first IP is * as opposed to 127.0.0.1 So, complicate that PORT:IP:PORT part after the -R, to be IP:PORT:IP:PORT and make that first IP * and it should allow others to connect, I suppose, see if that works. I think it's * rather than 0.0.0.0 but report back. Though from what i've read, I think * should be default.
    – barlop
    Dec 24, 2012 at 0:50
  • It looks like in my case at least, it's defaulting to 127.0.0.1 So using * or 0.0.0.0 might do it. But try it and see. Also, You ask if it can be shared. But, can 2+ computers connect to your camera at your remote side e.g. even not using ssh, is it possible to do it?
    – barlop
    Dec 24, 2012 at 1:06
  • hi. I agree, using local and remote is unclear. Yes the "3G" computer is behind a NAT pool when it connects (gets a 10. address). This is the problem. If it was getting a real internet address I could connect directly to it directly from outside. Because I can't I creating the SSH connection and then tunnelling back down it. As I mentioned this works fine from the "Internet" computer and I can connect to the webcam fine. The final hurdle is to allow another computer to use this tunnel, not just the "Internet" computer.
    – Matt Cooper
    Dec 26, 2012 at 11:23

1 Answer 1

Reset to default
2

I think you need -o GatewayPorts=yes to allow other hosts than local to use your tunnel. From the man-page:

Specifies whether remote hosts are allowed to connect to local forwarded ports. By default, ssh(1) binds local port forwardings to the loopback address. This prevents other remote hosts from connecting to forwarded ports. GatewayPorts can be used to specify that ssh should bind local port forwardings to the wildcard address, thus allowing remote hosts to connect to forwarded ports. The argument must be “yes” or “no”. The default is “no”.

Improve this answer
1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .