How can I copy from a server on the internet to a server behind a router doing NAT?

Question

I have both a VPS and a server behind a NAT firewall. I want to use the server behind a NAT firewall as a backup for the VPS. The VPS needs to be able to initiate the backup process and send the backups over the internet, past the router doing NAT and to the backup machine. I do not have control over the router, so my backup machine has no public IP address.

Is there a way for me to open a SSH tunnel (or equivalent) from the backup machine to the server such that the server can copy files across this connection?

Topology like so:

 ________                      _______________      ________
| server | -- ( internet ) -- | router w/ NAT | -- | backup |
 --------                      ---------------      --------

Answer 1

I do this, but I do it backwards.

I have OpenVPN server run on the server, with the backup running an OpenVPN client. This is because the server doesn't change IP addresses. Now, as long as the backup is up, it doesn't matter what IP address the NAT box has, it will always have the same IP on the OpenVPN network, and the server can always find it.

Also for bonus, since the OpenVPN connection is "outgoing" through the NAT, as long as the UDP port is permitted out (which it is by default on most devices), there is no special configuration required for the NAT device either.

Answer 2

Open a SSH connection from your home server to the VPC, enable tunneling so that the VPC computer can connect to services on the home computer; rsync or ftp would probably be easiest.

Answer 3

Secure file transfer protocol is quite a good and secure solution, but there are other solutions as the use of rsync or maybe FTP.

For rsync you may open the port n° 873 on router and forward it to backup target. For simple FTP issue there are two symmetric solution, first one is to open ftp port on backup target and do forwarding again. The second one is seems to be useful for you even you don't have access to the router for changing NAT rule, well in this case you have to setup a FTP daemon on the server as repository and make a synchronized script that will do transfer to backup machine.

Also, a tunneling solution seems to be a good alternative, so i recommend you OpenVPN.

Answer 4

Answering my own question:

This just goes to show that all you need is a new search term: "reverse", as in "ssh tunnel reverse".

So to create a reverse SSH tunnel, run SSH from the machine behind NAT (backup, in my example) with -R and specify which remote port to bind to a local port, so:

ssh -R remote_bind_port:localhost:local_port remote_user@server

So, for example:

ssh -R 1222:localhost:22 backup@example.com

Would bind port 1222 on example.com to the localhost port 22. That is: a user on example.com can do ssh localhost -p 1222 in order to traverse the NAT and connect to the SSH server on the machine behind the router.