Specific problem: Given I have one machine with real IP address (an Amazon Linux instance) A1 and I’m on my personal local machine L1 and I have a little server running at home L2

how can I ssh into L2 from L1 like I do to A1? if L2 has no real IP...

I’m running many many java microservices on aws machines, all of these services do not need to scale up down, I don’t need any of the fancy features that cloud providers offer yet the more services I run the bigger my bill gets and the more complicated communication between them...

So I want now to buy a server machine with lots of RAM and CPU, run all those services on it and avoid using AWS or any provider at all... I have different scripts that will ssh into remote host and do some deployment related work... I want them to still operate with L2 when I execute them from personal machine...

If there are simpler ways to do this, please suggest. But for now I see two solutions, either I get real IP address from the operator, or I use aws or some dummy machine with real IP to connect two L1 and L2 machines...

I’ve hardly done any administration of any infrastructure so pardon me if it’s a noob question...

  • Is L1 on the same network as L2 (are they both connected to the router that connects to the internet)? If so, you have local IP addresses that start with either 10.1.x.x or 192.168.x.x. From the server and your L1 machine, run ip addr to see what that address is. – mcalex Aug 23 '17 at 6:51
  • no they dont, assuming my home server runs 24/7 but i might be anywhere in the world, i must be able to log into the machine... – vach Aug 23 '17 at 6:52
  • Your server external IP can be found by googling: whatsmyip (from a browser on the server) – mcalex Aug 23 '17 at 6:54

If your L2 server is on your home network then it is behind your router and not visible from the Internet by default (which means no machine on the Internet can open a connection to it). As said above, it is in your local home network with an address of 10...* or 192.168..

From the point of view of the Internet (and this includes your L1 system when you are not at home) the only device with a true Internet address is your router, and all your home machines connecting to the Internet appear to have that address (so you can obtain the Internet address of your router by going to some site such as showmyip.net with your Internet browser). The benefit of the setup is that that the random hacker cannot open a connection to your machines.

You can usually ask your router to forward connections requests to some port (for instance SSH) to one specific machine (IP address) in your local network, so SSH-ing to your Internet address from anywhere on the Internet would actually connect you to your L2 server. See example instructions here.

Note that this may not be such a good idea (because if you make a mistake you can open you home network to hackers and if something bad happens your Internet address can be blacklisted). That also requires that you have a fixed network address (or that you can find your new address easily when it changes). The hosted server is still usually a better solution, but AWS isn't the only provider, you can get barebones VPS Linux servers for $5 a month.

| improve this answer | |
  • So if i understand correctly my router has an IP address which does not change unless i log into router and change myself. And i can forward connections. Forwarding is great and it seems to be exactly what i want. Now to avoid some random hacker sshing into my machine can i generate a .pem key (or something like that) such that only whoever has it can ssh successfully into L2? kind of like aws requires it... – vach Aug 23 '17 at 9:02
  • i think i found it digitalocean.com/community/tutorials/… – vach Aug 23 '17 at 9:04

This is exactly the kind of problem SSH remote forwarding solves.
This requires that you have a A1, a machine that has a real IP. A machine with very limited resources is OK as it only acts as a jump board.
Since L2 doesn't have a real IP, you need to initiate a ssh connection from L2 to A1 and create a tunnel:

root@L2# ssh user@A1 -R 9022:localhost:22   

So now whenever a connection reaches port 9022 on A1 it is forwarded to port 22 on L2.
Now you can 1) SSH to A1 2) from there SSH to localhost 9022

You can do some fine tuning on this solution of course, for example automatically re-initiate the connection from L2 to A1 when disconnected. for example, let SSH listen on port 9022 on the real IP instead of loopback address (requires editing SSHD config).

| improve this answer | |

Guide for connecting to home computer by ssh from internet:

  1. If you have a static ip behind router you can connect to your home computer from internet
  2. Forward 22 port on your router, here is a some example how to do it
  3. Install openssh-server on your local machine:

    sudo apt install openssh-server

  4. Allow connection to 22 port for local machine:

    iptables -A INPUT -p tcp --dport 22 -j ACCEPT

  5. Test your connection from remote machine using telnet:

    telnet you_external_ip 22

  6. Connect to local machine using ssh:

    ssh your_external_ip

  7. For safety connection you can setup ssh two-factor authentication

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.