7

I am able to accept reverse SSH connections from multiple remote systems on a single server using a port for each connection:

Remote A: ssh -fN -R5000:localhost:22 user@server-ip -p22
Remote B: ssh -fN -R5001:localhost:22 user@server-ip -p22
Remote C: ssh -fN -R5002:localhost:22 user@server-ip -p22

I can access these systems from my local client as needed:

Access Remote A: ssh root@server-ip -p5000
Access Remote B: ssh root@server-ip -p5001

This requires forwarding one port per remote system on the server. When 100+ remotes connect, do I have any options other than opening 100+ ports in the server firewall and statically assigning each remote to a port as above? My goal is to enable multiple remotes to create tunnels on demand, where I can query who is connected.

I found that sslh is a multiplexer that can differentiate between traffic on a single port based on protocol but this only applies to different protocols eg. ssl/ssh. Is there a solution that allows multiple tunnels on a single port?

Example:

Remote A: ssh -fN -R5000:localhost:22 user@server-ip -p22 -identifier abc123
Remote B: ssh -fN -R5000:localhost:22 user@server-ip -p22 -identifier def456
access Remote A: ssh root@server-ip -p5000 -identifier abc123
access Remote B: ssh root@server-ip -p5000 -identifier def456
  • 6
    You haven't explained your business need, but it looks to me like you've stretched ssh past what it's designed to do; you really need a proper VPN of some kind. – MadHatter supports Monica Jun 20 '14 at 7:13
3

I have the same issue you do and, by the time, have only arrived at one possible answer. My scenario is a bit different than yours as I only need one active ssh tunnel, but all clients must be ready to connect if needed.

I guess one could create a client/server simple protocol to handle all the clients and create a list of some sort. The user then could chose one of the clients to create the reverse tunnel. Doing that would require another open port rather than the ssh server, but using a threaded server one could listen() to various clients under the same port for this secondary protocol.

I'm still working on a solution (I'll probably implement what I just wrote), but mind you in your case you should decide the max number of clients connected at a single time and configure that amount of ports. As mine is just a small linux "support" for embedded devices, I can only work on one device at a time anyway, so I only need 1 device.

A cleverer idea would be to inform the client over the aux protocol at which server port to attach the reverse tunnel.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.