Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have both a VPS and a server behind a NAT firewall. I want to use the server behind a NAT firewall as a backup for the VPS. The VPS needs to be able to initiate the backup process and send the backups over the internet, past the router doing NAT and to the backup machine. I do not have control over the router, so my backup machine has no public IP address.

Is there a way for me to open a SSH tunnel (or equivalent) from the backup machine to the server such that the server can copy files across this connection?

Topology like so:

 ________                      _______________      ________
| server | -- ( internet ) -- | router w/ NAT | -- | backup |
 --------                      ---------------      --------
share|improve this question
+1 from developer. Keep going! – Gennady Vanin Геннадий Ванин Aug 13 '10 at 16:46

I do this, but I do it backwards.

I have OpenVPN server run on the server, with the backup running an OpenVPN client. This is because the server doesn't change IP addresses. Now, as long as the backup is up, it doesn't matter what IP address the NAT box has, it will always have the same IP on the OpenVPN network, and the server can always find it.

Also for bonus, since the OpenVPN connection is "outgoing" through the NAT, as long as the UDP port is permitted out (which it is by default on most devices), there is no special configuration required for the NAT device either.

share|improve this answer
+1 for openvpn ! – Antoine Benkemoun Aug 30 '10 at 10:29

Open a SSH connection from your home server to the VPC, enable tunneling so that the VPC computer can connect to services on the home computer; rsync or ftp would probably be easiest.

share|improve this answer
He says he has no control over the router/NAT. – David Mackintosh Aug 13 '10 at 1:06
@David, Thank you for pointing out my error; switched the solution. – Chris S Aug 13 '10 at 1:32

Secure file transfer protocol is quite a good and secure solution, but there are other solutions as the use of rsync or maybe FTP.

For rsync you may open the port n° 873 on router and forward it to backup target. For simple FTP issue there are two symmetric solution, first one is to open ftp port on backup target and do forwarding again. The second one is seems to be useful for you even you don't have access to the router for changing NAT rule, well in this case you have to setup a FTP daemon on the server as repository and make a synchronized script that will do transfer to backup machine.

Also, a tunneling solution seems to be a good alternative, so i recommend you OpenVPN.

share|improve this answer
up vote 0 down vote accepted

Answering my own question:

This just goes to show that all you need is a new search term: "reverse", as in "ssh tunnel reverse".

So to create a reverse SSH tunnel, run SSH from the machine behind NAT (backup, in my example) with -R and specify which remote port to bind to a local port, so:

ssh -R remote_bind_port:localhost:local_port remote_user@server

So, for example:

ssh -R 1222:localhost:22

Would bind port 1222 on to the localhost port 22. That is: a user on can do ssh localhost -p 1222 in order to traverse the NAT and connect to the SSH server on the machine behind the router.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.