2

Is there software that will help me to ssh/connect to my home computer from the public internet? (Say, a coffee shop).

I understand that questions similar to this have been asked, but none seem to actually answer the question. Let me add some details to avoid the usual slew of answers about DynDns and port forwarding.

  • I have access to a publicly accessible SSH server. Merely port forwarding from there is not a stable solution that lasts several days. Port forwarding tends to drop connections, be slow etc.

  • I dont want to setup/pay for DynDns and configure NAT traversal on my router.

I feel the following should be possible, I just dont know if there exists software that already accomplishes this:

Just the way peer-to-peer programs hole-punch NAT traversal, it should be possible to have a program running on my home machine that opens up external access to the appropriate ports by hole-punching. Further, the program can broadcast the home computers public IP and hole-punched externally visible port somewhere (say on a public server or over email) and periodically update this information.

Does software like this exist? A part of this functionality is already accomplished by various torrent software.

4
  • 2
    not sure what setup you are trying to avoid with DynDNS. The free version available involved signing up with them, downloading an updating client, and then putting the signup email/password combo used into the client once. You then have the address you signed up for to connect to the machine. As far as port forwarding through your router... it's a relatively painless two step. One... assign that computer a static IP in the DHCP reservation table, then forward port 22 to that IP. Then, you just SSH from any computer to your address:22. Not that bad, really.
    – Bon Gart
    Aug 20, 2012 at 21:49
  • In what way does (free) dynamic DNS and simple port forwarding not answer the question? Aug 20, 2012 at 22:01
  • DynDNS is free, and many (most?) routers also have a built-in DynDNS client, so you don't even have to run it yourself. You could try using a reverse SSH tunnel to get around the NAT, but port forwarding is probably more reliable.
    – user55325
    Aug 20, 2012 at 22:13
  • Could you please clarify: When being at the coffee shop, would you use your own device (e.g. laptop) to access the internet, or would you use the coffee shop's devices (if they provide such devices for public usage)?
    – Binarus
    Feb 13, 2022 at 10:46

2 Answers 2

0

I do not suggest placing your device into a DMZ under any circumstance, unless you really know what you're doing and can properly secure the device and the network surrounding it.

There is software that can emulate a LAN through the internet, called LogMeIn Hamachi. By installing and enabling this on the host, you can access it by logging into the VLAN anywhere on the internet.

Although I don't necessarily see the problem with Port Forwarding.

Another option is to use SSH's built-in Port Forwarding feature. If there is another SSH host accessible from the internet (we'll call it Host 1) on the same LAN as the host you're trying to connect to (Host 2), you can issue a command that bounces the connection from your computer (on a specific local port) through Host 1, and Host 1 routes your traffic to the non-port-forwarded Host 2 in it's LAN.

The command is as follows and is to be executed on the local machine that you're trying to use to connect to Host 2

ssh -L [local-port-to-open]:[local-IP-of-Host-2-according-to-Host-1]:[port-to-connect-to-on-Host-2-from-Host-1] [user-of-Host-1]@[Host-1-address]

This will open a port on your machine (your [local-port-to-open] argument) that SSH manages, sending any traffic from that port through the encrypted tunnel made my the [user-of-Host-1]@[Host-1-address] arguments to Host-2 as specified in [local-IP-of-Host-2-according-to-Host-1]:[port-to-connect-to-on-Host-2-from-Host-1]. This method is called Local Port Forwarding (I don't really understand remote port forwarding).

For example, say I want to connect to Host 2, which is not port forwarded, from my local coffee shop, using Host 1, which is port forwarded, to bounce the connection into it's LAN. Note that this will open a PTS on the remote machine, but it can be ignored until you want to close this tunnel. Then you can just close that terminal session as you would normally.

Host 1's public IP is 201.31.103.212 (the NAT that encapsulates both Host 1 and Host 2) on port 1337 for SSH. Host 2, in the LAN, has the local IP of 192.168.254.40 and uses port 22 for SSH. Host 1's login username is fish.

Ok, so I'll just say that I have the local port 8080 unused and can use it for this demonstration temporarily.

The command I would form is as such:

ssh -L 8080:192.168.254.40:22 [email protected]

Now that opens port 8080 on your local computer and sends to to 192.168.254.40 on port 22 (Host 2) according to Host 1 (which is [email protected])

Now if you want to SSH into Host 2, all you have to do is specify your computer on port 8080. Let's say that Host 2's login username is turtle

ssh [email protected] -p 8080

SSH is managing your port 8080, and it sends your SSH request to Host 1, which sends it to Host 2. Please note that, as opposed to using 127.0.0.1, you can also just use localhost. It's just preference.

Another use of SSH Port Forwarding is proxies.

Scenario: I'm at school with my personal laptop and want to access Twitter, which is blocked (it actually is at my high school, so I've done exactly this). I have a port-forwarded SSH host at my house with the IP 39.34.81.56 on port 1337. I want to bounce a connection to Twitter (web servers are most commonly hosted on port 80) from my port 8080 on my laptop through my host at home. I would issue the command on my laptop:

ssh -L 8080:twitter.com:80 [email protected] -p 1337

Now I can access localhost:8080 in my web browser, and it will route Twitter through my encrypted tunnel, from their servers to my home then to my laptop at school.

I can use this same method to log into a website that does not use SSL (pastebin for example) in public and be sure that my credentials are safe because it's encrypted using SSH and only sent without SSH from my home, which I've made sure is secure.

Good luck!

EDIT: Just a side note, the IP addresses shown here should not be valid addresses, but on the off-chance that they are, please do not harass the users of these IPs.

1
-1

Ya so I think port forwarding IS the hole punching method. If you wanted, you could put your computer in a DMZ and avoid all the mess.

2
  • I wouldn't put a computer permanently in a DMZ unless you REALLY know what you're doing with network security.
    – danielcg
    Jun 15, 2016 at 18:16
  • Port forwarding is something very different than hole-punching. There's not enough room to explain the basics here, though ...
    – Binarus
    Feb 13, 2022 at 10:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .