SSH connection established by the remote server to my laptop

Question

I have a vm running ubuntu. I use that vm by connecting to it via SSH. My problem begins with some policy enforcement that blocks all incoming traffic coming from the internet.

The vm can make outbound connections with no limitations, however there can be no port opened to the internet for incoming connections.

Assuming I can execute scripts on the vm, I wonder if it's possible to make it connect to my IP, using some port, and by that establish an SSH session.

What I imagine is this:

vm:

• tries to establish a connection on port 6543 to my constant IP address 1.1.1.1.
• keeps retrying until the connection is established
• once the connection is established, keep that connection open.

my laptop:

• run some daemon to listen on port 6543 and wait for a such connection from the vm
• once the connection is established, listen on some port locally, say 8022 ssh to localhost:8022 and get an SSH session established to my vm

My knowledge of networking tells me it's feasible. However, I am not sure how to implement that, and furthermore if there's already a utility for that.

Answer 1

What you describe can be achieved by using ssh remote forwarding.

Assuming you have ssh daemons running (and listening to the default port 22) in both your vm and your local machine, you need to run this command in your vm (assuming 1.1.1.1 is your local IP address):

ssh -fN -R 2222:localhost:22 1.1.1.1

This creates an ssh tunnel that listens to port 2222 in your local machine and forwards this port to port 22 in your vm. That means, you can connect to your vm from your 1.1.1.1 machine with this command now:

ssh -p 2222 localhost

Update (some additional information)

The -fN is for letting this command run in the background. Note that this may be killed after some time out, if you need this to be run permanently, you would need to make a script/cronjob that restarts it if it dies for whatever reason, and you should also configure some client and server keepalives to prevent the tunnel connection from getting closed from inactivity.