0

I have a Mac laptop (computer A) running OS X el capitan that I would like to remotely access with SSH. Since the computer is always on my school network, I cannot get a static, public IP address. After doing research, I've learned that I can

  1. set mac os x to request a certain private IP on my school network
  2. use ddclient to always update the public IP my computer has to nsupdate.info such that a static url always points to computer A

As mentioned before, computer A is on my school network. How can I use my computer (computer B) on my home network, which is far from my school, to ssh into computer A?

Let's say I have set computer A to configure IPv4 using DHCP with manual IP address 172.27.133.200 and to use ddclient to update testurl.nsupdate.info to always point to the public IP address of computer A. Is there a command that would use these two addresses such that I can connect, e.g. (conceptually)

userOnComputerB$ ssh [email protected]@testurl.nsupdate.info

I also welcome other solutions that work within the confines of the problem. I have consulted other questions involving reverse tunneling and port forwarding, but don't see how they apply to this, because I think I do not have any control over the port forwarding of my school network routers.

Lastly, if a command like the one above is not possible, what is the technical or ssh design reason why such a command is not possible?

Improve this question
2
  • Your credentials have to be granted access from the school's Network Administrator. Start there, they are the only one who can allow you access to the network remotely.
    – ejbytes
    Aug 19, 2016 at 21:33
  • 1
    In the reverse tunnel question that you refer to, consider lappy to be your school computer and remotey to be your home computer. Does that not achieve what you want?
    – hertitu
    Aug 19, 2016 at 23:11

1 Answer 1

Reset to default
0

When you SSH to testurl.nsupdate.info the connection will terminate at your school's firewall (or other device which implements NAT for your internal IP 172.27.133.200). The firewall will not know that this needs to be forwarded to your internal IP, unless the firewall admin had configured port forwarding but as you say, you have no control over that.

If you think of it, the firewall's mean reason for existence is exactly to prevent someone on the outside to be able to connect to a device on the inside (except those connections that the firewall admin approved).

However, typically the firewall does allow your internal device to SSH to the outside, so then you could use that outbound SSH connection to tunnel an inbound connection, which is explained in questions involving reverse tunneling that you mentioned. Just read this while keeping in mind that "lappy" is your school computer and "remotey" your home computer.

Improve this answer
5
  • In the linked example, the author says that lappy and remotey are on the same network, and remotey is used as an intermediate point between lappy and another computer (which the OP refers to as computer C). Does this mean that it is necessary to use 3 computers, where lappy and remotey are on the same network, and computer C is on my home network?
    – anon294719
    Aug 22, 2016 at 12:18
  • I could do that, but as the author writes, that requires two steps: first login to remotey then use the reverse tunnel port. I would like data to be end-to-end encrypted between the home computer and lappy. Would that be the case if I logged-in to remotey as an intermediate? Is there one single command I could use to merge these two steps?
    – anon294719
    Aug 22, 2016 at 12:18
  • ok sorry if that was confusing. Ignore the question in the linked example, focus on the first part of the answer that just talks about lappy and remotey. This part is where you should have a working connection from remotey (home pc) to lappy (school pc): test out reverse tunnel port [user@remotey ~]$ ssh -p 12345 localhost should now be back on lappy user@localhost's password: Last login: Thu Aug 1 17:53:54 2013 /usr/bin/xauth: creating new authority file /home/user/.Xauthority [user@lappy ~]$
    – hertitu
    Aug 22, 2016 at 12:25
  • Ok, thanks. However the author of the answer is able to do that login because lappy and remotey are on the same network. In my case neither my school computer nor my home computer have static public IPs. Does that mean the intermediate computer is necessary? Could I use one login for end-to-end encryption?
    – anon294719
    Aug 22, 2016 at 12:38
  • Ok I didn't realize that your home computer does not have a public IP. In that case I think you have 2 options: indeed use a third computer "C" that has a public IP. Or configure DDNS on your home PC and from the school PC set up the SSH tunnel towards "myhomepc.nsupdate.info". Configure your home router to do port forwarding to your home PC. Downside is that you will need to somehow restart the tunnel when your public IP at home changes; I suppose you could write some cron job that tests if the ip has changed and then re-established the connection.
    – hertitu
    Aug 22, 2016 at 12:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .