1

I have three machines:

  1. I have physical access to localhost
  2. I want to ssh into host1. However, it is behind carrier-grade NAT, so I can't ssh directly to it from localhost
  3. relayhost is set up to help me connect from localhost to host1

I want to ssh from each localhost and host1 to relayhost, then have relayhost relay my ssh connection from localhost to host1.

This answer suggests I can create a tunnel on relayhost using ssh -L if I know the URI or IP address of host1. However, I don't know that because of the carrier grade NAT. So I can imagine a process to relay it like this:

  1. On host1, ssh user@relayhost
  2. relayhost is watching for this connection and when it sees it says "I'm going to create a tunnel from my port 9999 to this connection"
  3. On localhost, ssh 9999:relayhost

Is this the right way to go about this? How do I do step 2?

  • been a while but out of interest, how is relayhost able to get past machineB's carrier grade NAT? the qna you link to doesn't mention anything about carrier grade nat. – barlop Nov 29 '17 at 17:17
  • @barlop i think his problem is that both localhost and host1 are behind NAT, he can't circumvent it... – Marek Rost Nov 29 '17 at 17:17
  • So say you have host1, hostX, machineB. You could have the host you want to connect from, connect to some other host that is not behind carrier grade NAT. Call it hostX. Then you could connect host1 to hostX, and have that automatically jump to your MachineB. So from MachineB I suppose it'd be something like machineB$SSH -R 1234:127.0.0.1:1000 hostxIP Then host1$SSH hostx:1234 And that should connect indirectly, to machineB on port 1000. – barlop Nov 29 '17 at 17:18
  • You haven't even showed yourself trying anything in your question. I mentioned SSH -R and you never did anything with it. The posted answer also mentions SSH -R and it's still not clear whether you have tried anything. – barlop Nov 30 '17 at 15:56
4

You don't need any specialized triggers on relayhost. All you need to do is use remote port forwarding with ssh -R instead of local port forwarding with ssh -L.

Now if i understand it correctly - your problem is that neither localhost nor host1 have publicly accessible IP - both are behind NAT. Otherwise it would be easier create tunnel from host1 to localhost with ssh -R and then run second SSH connection inside this tunnel.

If we have to use the relay, it can be done in following steps. For clarity let's rename your localhost machine to myhost now.

  1. Run this on host1:

    ssh -R 12345:localhost:22 user@relayhost
    

    This will open port 12345 on relayhost and when anyone connects to it, the data will be forwarded to SSH port 22 on host1.

  2. Now you can connect to port 12345 on relayhost from myhost.

    ssh user@relayhost -p 12345
    

    In case that you have restrictive firewall on relayhost that prohibits external access to port 12345, you can use local port forwarding to open the port locally on myhost:

    ssh -N -L 56789:localhost:12345 user@relayhost
    

    And then connect to host1 from myhost:

    ssh user@localhost -p 56789
    

However don't expect to build any permanent networking solution on remote port forwarding (see: https://serverfault.com/q/595323 for future possible problems). You should consider using VPN with server on relayhost for long term setup instead.

  • Great explanation of how to set up the ssh relay. Can you point to a reference for how I might go about setting up that VPN? – ericksonla Nov 30 '17 at 3:58
  • 1
    @ericksonla no he didn't and shouldn't explain to you how to set up a VPN 'cos that's not what you asked about in your question. If you are struggling to set up a VPN then ask a question on that, stating what problem you have – barlop Nov 30 '17 at 15:54
  • 1
    @ericksonla look up OpenVPN, plenty of tutorials around. – Marek Rost Dec 1 '17 at 18:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.