Reverse SSH tunnel from Hunter to Base

This is my method to keep connected with a remote Raspberry Pi that has a static external IP address and lives behind a NAT, where I don’t have control over the router (so no port forwarding). For your use case, you might want to choose another method (there are plenty on the world wide web, I’m sure you can find them), but the simple method below works for me.

on Base

Create a new user with adduser tunnel

user tunnel
pass SomeComplicatedPass

You need a modification to sshd_config. At the end of the file, add a Match block to prevent password-based logins (only allow keybased logins for user tunnel) so the password above is of little use to the outside world

# Match blocks must be at the and of this config file, see:
# http://unix.stackexchange.com/questions/67334/openssh-how-to-end-a-match-block
Match User tunnel
    PasswordAuthentication no

on Hunter

Login to Hunter. I assume evert as your username on Hunter

Create the reverse tunnel using:

ssh -N -R 2222:localhost:22 tunnel@Base

Or, more sophisticated:

autossh -M 0 -q -f -N \
-o UserKnownHostsFile=/dev/null \
-o StrictHostKeyChecking=no \
-o "ServerAliveInterval 60" \
-o "ServerAliveCountMax 3" \
-R 2222:localhost:22 \
tunnel@Base

This can be done best by doing it from cron and with a script.

crontab -e
@reboot /home/evert/tunnel.sh 60

My script is named tunnel.sh.

You can download my files: reverse_ssh_tunnel.zip

Usage

First login to Base, then connect to Hunter using:

ssh evert@Base
ssh localhost -p 2222

And from there, you can play with Hunter.

Have fun!

Hunter base shot from Mega Man X5
Just a random picture from the internet. “Hunter base shot from Mega Man X5”, source: Megaman wikia
     

avatar
Evert geeft hier actuele en minder actuele commentaren over informatietechnologie, oude mythen, politiek, zijn persoonlijke belevenissen en wat hij nog meer leuk vindt. Evert heeft een MA politicologie en een MSc medical informatics.

Furor Teutonicus is geen blog voor de massa of het grote publiek. De artikelen zijn geschreven voor de enkele geïnteresseerde en ook voor vrienden en familie. Een blog hoort af en toe sterke opinies ("furor") naar voren te brengen; de meerwaarde zit dan in de kracht van de argumenten en de dynamiek van de resulterende discussie.

Mijn contactinformatie is te vinden op: www.evertmouw.nl