Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am able to accept reverse SSH connections from multiple remote systems on a single server using a port for each connection:

Remote A: ssh -fN -R5000:localhost:22 user@server-ip -p22
Remote B: ssh -fN -R5001:localhost:22 user@server-ip -p22
Remote C: ssh -fN -R5002:localhost:22 user@server-ip -p22

I can access these systems from my local client as needed:

Access Remote A: ssh root@server-ip -p5000
Access Remote B: ssh root@server-ip -p5001

This requires forwarding one port per remote system on the server. When 100+ remotes connect, do I have any options other than opening 100+ ports in the server firewall and statically assigning each remote to a port as above? My goal is to enable multiple remotes to create tunnels on demand, where I can query who is connected.

I found that sslh is a multiplexer that can differentiate between traffic on a single port based on protocol but this only applies to different protocols eg. ssl/ssh. Is there a solution that allows multiple tunnels on a single port?

Example:

Remote A: ssh -fN -R5000:localhost:22 user@server-ip -p22 -identifier abc123
Remote B: ssh -fN -R5000:localhost:22 user@server-ip -p22 -identifier def456
access Remote A: ssh root@server-ip -p5000 -identifier abc123
access Remote B: ssh root@server-ip -p5000 -identifier def456
share|improve this question
5  
You haven't explained your business need, but it looks to me like you've stretched ssh past what it's designed to do; you really need a proper VPN of some kind. – MadHatter Jun 20 '14 at 7:13

I found that sslh is a multiplexer that can differentiate between traffic on a single port based on protocol but this only applies to different protocols eg. ssl/ssh. Is there a solution that allows multiple tunnels on a single port?

SSH tunneling is not designed to do that. And the only way to differ one tunnel from another is unique port number.

If you have about the hundred of tunnels already I can strong suggest you to look for the VPN solution. It can be OpenVPN, look here for some example of install and config.

You'll need to open only one port outside and your clients can connect. You also can use iptables to control where your clients can connect, etc.

share|improve this answer

I have the same issue you do and, by the time, have only arrived at one possible answer. My scenario is a bit different than yours as I only need one active ssh tunnel, but all clients must be ready to connect if needed.

I guess one could create a client/server simple protocol to handle all the clients and create a list of some sort. The user then could chose one of the clients to create the reverse tunnel. Doing that would require another open port rather than the ssh server, but using a threaded server one could listen() to various clients under the same port for this secondary protocol.

I'm still working on a solution (I'll probably implement what I just wrote), but mind you in your case you should decide the max number of clients connected at a single time and configure that amount of ports. As mine is just a small linux "support" for embedded devices, I can only work on one device at a time anyway, so I only need 1 device.

A cleverer idea would be to inform the client over the aux protocol at which server port to attach the reverse tunnel.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.