Is there a way to establish a SSH connection over UDP?

I'm running behind a "filter all inbound TCP traffic" firewall so I cannot utilize a SSH tunnel properly.

I have set up over at my brothers that I have control over (SSH). I want to connect to it from behind the firewall to somehow port forward to the MySQL and Redis databases I have on my servers behind the firewall.

  • 5
    OpenVPN typically runs over UDP. If you can establish an OpenVPN connection, you could ssh over that, although then you should also be able to directly access your MySQL and REDIS without using ssh as another transport tunnel layer. – user4556274 Sep 24 '16 at 15:11
  • Assuming here that you have confirmed UDP is not firewalled. – nik Sep 24 '16 at 20:01
  • What exactly is, from your perspective, behind the firewall? You? Or the SSH server host? Why do you think it wouldn't block UDP? Is the firewall a NAT router? – Daniel B Sep 24 '16 at 21:03
  • Just connecting to a VPN does not work as I'm sure you need to port forward something to the VPN network and back. UDP comes back as open by nmap and I can use OpenVPN over UDP by specifying any random UDP port range. From my perspective, I am behind the firewall and so is the server I want to port forward to. I'm not really sure what type of firewall it is, but I know there are 3 routes from the external point to my internal router, so it could be anything really. I do know for sure UDP works though. – B. Garrison Sep 25 '16 at 0:36
  • 1
    @B.Garrison: "Just connecting to a VPN does not work as I'm sure you need to port forward something". No, if you have a VPN connection between your local network and the remote network, there is no need for any port-forwarding. – user4556274 Sep 28 '16 at 11:35

The Mobile Shell (Mosh).

Prerequisites of the server

The major drawback of mosh is that it requires the server to fulfill additional prerequisites which are not needed by ssh itself. Due to its design, mosh needs the server to allow direct connections via UDP. Servers not fulfilling these prerequisites cannot be used by mosh. Examples of such systems include servers behind firewalls which restrict connections to the ssh-port via TCP. Also problematic are servers which are only indirectly reachable. The latter is usually accommodated by ssh via the 'ProxyCommand' option, but this is not supported by mosh.

One port per connection.

By default, the server tries to allocate the first free UDP port in the range 60000-61000, per connection. This dynamic port allocation is considered an extra burden and risk for firewall maintenance. A significant part of the firewall-filtering happens through connection tracking, so called stateful filtering, this is based on the SYN/ACK flags in TCP segments, UDP packets don't have such flags.

Other things.

  • No IPv6 roaming support.
  • Scrollback is not supported in the current release of mosh, and when using it in a terminal emulator with scrollbars they disappear.
  • Lack of SSH-Agent forwarding.
  • Lack of X-11 forwarding.

For more see SSH vs Mosh.

| improve this answer | |
  • 1
    Mosh would solve SSH access, but I still need my databases forwarded and some other services too. Thanks for the suggestion though! – B. Garrison Sep 25 '16 at 0:39
  • 1
    Although mosh is cool, it requires both tcp and udp. It first connects via regular ssh, then drops to udp. – Ivan Mar 13 '18 at 15:51

Check out hscp, which isn't exactly what you're looking for but may have some of the features you want. UDP-based SCP, plus I think some SSH basics. https://ccportal.ims.ac.jp/en/software/hscp

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.