1

Consider I have three computers

  1. home my computer at home
  2. work my computer at work
  3. server my server

I can't connect from home to work using ssh because of my company firewall. But I can ssh any computer from work. For example I can ssh the server computer from work. What I wan't to do is to connect to Internet using the work connection (I want to access localhost of the work computer). I read from some toturial that I can do:

woork:~# ssh -D 4096 server

But this only allow me to connect to the Internet using the server. I want to do the inverse of this but I can't access work from server.

The final result is to open firefox at home and browse to localhost of work.

What's the solution for my case?

7
  • @DavidPostill This can't be done using a tunnel?
    – Hunsu
    Oct 19, 2015 at 13:55
  • @DavidPostill you write an absolutely misleading comment, he is talking about ssh and ssh can do a reverse tunnel which can deal with a firewall that you can't control.
    – barlop
    Oct 19, 2015 at 14:11
  • You want a reverse tunnel. That's ssh -R
    – barlop
    Oct 19, 2015 at 14:13
  • 1
    @barlop You still need appropriate ports open though. There is no indication in the question that he can ssh outside of his company network. In any case he should still ask for permission to do this. A better solution would surely be for his company to set up a VPS if he needs to work from home.
    – DavidPostill
    Oct 19, 2015 at 14:17
  • @DavidPostill Ports open normally implies incoming ports open. And most firewalls don't stop internet access so would allow outgoing port 80 and outgoing port 443 out(and maybe a load of other or all outgoing ports out). And sure he should ask permission if he is to ssh out but technically he can do it.
    – barlop
    Oct 19, 2015 at 14:26

2 Answers 2

4

If you can set up an outgoing ssh connection, then you can probably set up a reverse tunnel to get back in (I'm not aware of there being a way for IT to forbid this, but you never know).

work:~# ssh -fN -R 2222:localhost:22 server

Then on the server you can do this:

server:~# ssh -p2222 localhost

And you will magically be connected back to the SSH server port on you work machine. By default the port 2222 is bound to the "localhost" address only, so connect requests from home will not work:

home:~# ssh -p2222 server  ;# this will not work

Instead, you can do this:

home:~# ssh server
server:~# ssh -p2222 localhost

or both in one command like this:

home:~# ssh -o ProxyCommand="ssh -W localhost:2222" server

To make all this easier to live with, add this to your .ssh/config at home:

Host work
    ProxyCommand ssh -W localhost:2222
    HostName server

... and now:

home:~# ssh work

... will just do the right thing.

It is possible to create the reverse tunnel bind so that the proxy business is not necessary, but then every hacker in the world will also pound on your tunnel (thinking port 2222 is non-standard and therefore safe is naive). The failed access attempts will show up in the logs on "work", IT will find out, and you'll get fired. Of course, the tunnel alone is probably a firing offence, but there's no need to make it obvious.

3
  • You write "If you can set up an outgoing ssh connection, then you can probably set up a reverse tunnel to get back in (I'm not aware of there being a way for IT to forbid this, but you never know)." <-- well there would be a way. They could block outgoing ssh. It's unlikely that they would, but they could in theory , which seems to be what you're asking.
    – barlop
    Nov 5, 2015 at 12:21
  • @barlop "If you can set up an outgoing ssh connection ...." means the rest of the sentence only applies if IT have not blocked ssh, so your point makes no sense. As it happens, my employer does block some outgoing ssh connections (I think there's a white-list), and all connections to non-standard ports, I think.
    – ams
    Nov 5, 2015 at 13:54
  • yeah I must've forgotten the beginning of your sentence when I wrote that!! Indeed, if an outgoing ssh connection is allowed, then they cannot stop a reverse tunnel, or even multiple reverse tunnels, because from their perspective it all just looks like ssh which is all encrypted.
    – barlop
    Nov 5, 2015 at 14:07
1

Suppose you have

work:~#

home:~#

And work:~# is the firewall you can't control

When you write server, I see from context (ssh -D 4096 server), that you mean SSH server. (and not e.g. VNC server). You should specify really, it's clearer. Normally if you have an SSH server it'd be on either work or home. It should be on the computer with the firewall that you can control, that is, Home.

You'd also typically have a regular server that you want to reach, and that's normally not an SSH server. Though it can be, there's a question with a great example of where one might want it to be.

Perhaps you can explain more what server:~# is, but i'm going to skip it out in the meantime 'cos it seems unncecessary and it's not clear what you mean by it 'cos if you have an SSH server e.g. on work then you'd get a prompt work:~#

So what you do is

From the one you can't control i.e. work, you make an outgoing connection. 'cos the firewall lets them out.

home:~# START VNC server on e.g. 5901

home:~# START SSHD SERVER on e.g. port 80 <-- whatever the command is to start your sshd.

work:~# ssh -R 1234:127.0.0.1:5901 user@homeip -p 80

home:~# vncviewer 127.0.0.1:1234 

Home sees work.

really the switches to know for SSH are -L, -R and -D

And if you are connecting the client program to the listening port in such a way that the client program is on a different machine to your listening port, then it needs to be -R *:1234:127.0.0.1:5901 or 0.0.0.0:1234:127.0.0.1:5901

Though bear in mind, that's for something like VNC, but if you did it for HTTP you'd only be able to view one site. There is -D which as you see is local.

Some people are at home and want to access a server at work, and that server is behind a firewall they don't control.

But if you want internet access, then you're at work, wanting to access a server at home..

Why on earth can't you do that?

Try running the SSHD server on port 80 or port 443 at home, and do work~:#ssh homeip -p 443

3
  • home doesn't have static IP. That's why I use server which has a static IP. server refer to a computer (vps) not to a ssh server.
    – Hunsu
    Oct 21, 2015 at 14:22
  • noip.com/free "Use yourname.no-ip.info instead of a hard to remember IP address or URL to access your computer remotely. Additionally, use our free dynamic DNS update client to keep track of your dynamic IP address. You will always be able to access your computer even if your IP address is dynamically assigned."
    – DavidPostill
    Oct 21, 2015 at 14:30
  • @RobinA.Meade you've posted your question on the wrong answer, it was ams that wrote a line like that
    – barlop
    Feb 8, 2019 at 19:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .