Many embedded devices (running Linux) out in the fields, behind routers so NAT'd and we can't make connections to them.

We need for a support person to be able to initiate a terminal/shell session on any of the devices.

Their local terminal will also be NAT'd behind a corporate firewall, so we need some central "meeting point" that both they and the device can connect to.

If necessary, we could require the support person to log into some sort of terminal server, but I'd prefer a solution that just popped up a terminal window on their desktop.

We can (through other means) tell the device to execute some arbitary script or application to start up the session.

Without the NAT, it's just SSH to the device and away we go. But what are my options in this NAT'd environment?

We're OK to develop code at either end or at the meeting point server if required, but obviously if there are apps out there so we don't have to write stuff, even better.

Pointers to other questions I may have missed (although I have looked) or to applications that I should consider for the central "meeting point" server welcomed

  • How many embedded devices? Hundreds? Thousands? Tens of thousands? – dave4420 Aug 3 '12 at 10:29
  • Tens of thousands. But very few concurrent ssh sessions required - dozens, at most. This won't be needed often. – The Archetypal Paul Aug 3 '12 at 10:35

I'd suggest opening an SSH connection from embedded device to a server (we call this SERVER) under your control and creating a reverse port forward to embedded device port 22. You need to use non-static port number on SERVER because you have paraller connections. For example, say that you reverse port forward SERVER port 2222 to an embedded device port 22. Then you (or support person) can initiate full ssh connection to the embedded device by connecting to SERVER port 2222. This connection can be initiated from NAT'd environment. You still need to put SERVER on public IP but even some kind of dyndns solution should be enough.

After the ssh connection is established, you can stop listening port 2222 on the SERVER (that is, tear down the reverse port forwarding). As a result, you need to reserve listening ports on SERVER only for the duration of establishing new connections.

See man ssh and see flags -L and -R. I think you want to use -R. Note the bind address and requirement for GatewayPorts option to be enabled. See the section TCP FORWARDING for an example. If you need additional scripting on the embedded device, see also -f and ExitOnForwardFailure configuration option.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.