This is the setup I have :

  • a Linux box A inside a LAN behind a firewall.

  • a Linux server with a fixed IP address that is accessible from the internet.

I want to be able to connect to the Linux box that is behind a firewall from afar via ssh. I have read about ssh tunneling and it occurred to me that this could be my solution. I was able to open a remote ssh tunnel between the A and B. But I can't figure out how to use this tunnel to control A via ssh or if it's even possible. e.g : connect from my laptop to A via B.

This is the command as I understood it to open the tunnel :

ssh -R 2022:localhost:22 user@serverB

(requests via port 2022 transferred to port 22(ssh) on the target machine) via user@serverB.

After I open this tunnel what should be the actions to connect via ssh to the target machine?

Please correct me if my understanding is wrong here.


What you're referring is "SSH REMOTE FORWARDING", and is properly explained in the "man ssh", regarding the "-R" option.

> man ssh
 -R [bind_address:]port:host:hostport
    Specifies that the given port on the remote (server) host is to 
    be forwarded to the given host and port on the local side.
    This works by allocating a socket to listen to port on the remote 
    side, and whenever a connection is made to this port, the
    connection is forwarded over the secure channel, and a connection is 
    made to host port hostport from the local machine.

In your context, where:

  • a Linux box A (LINUX_BOX_A) inside a LAN behind a firewall.
  • a Linux server B (SERVER_B) with a fixed IP that is accessible from the internet

SSH remote forwarding can be used to reach LINUX_BOX_A from SERVER_B. The only condition is: LINUX_BOX_A MUST be able to connect via SSH to SERVER_B.

To achieve this goal you need:

  1. on LINUX_BOX_A:

LINUX_BOX_A:~ $ ssh -R 2222:localhost:22 user@SERVER_B

this will open an ssh connection from LINUX_BOX_A to SERVER_B that will be used for the remote, incoming, connection.

After above ssh connection is established, you can:

  1. on SERVER_B:

SERVER_B:~ $ ssh -p 2222 user@localhost

such ssh-connection, launched on SERVER_B, will be directed to the 2222 port listening on localhost that... is binded to the previous ssh connection. So this will be an "ssh connection within another ssh connection".

Some additional notes:

  • consider that if the first ssh-connection will timeout and/or fall down for whatever reason (including: killed by local firewall, due to inactivity), you'll be unable to remote-forward/remotely_connect;

  • as it's important to leave the first ssh connection active for really long time, you might find useful to launch such ssh within a "screen" session

A final note: Obviously, all of the above has some (potentially serious) security implications that are out of scope of this answer.

| improve this answer | |
  • Thank you. This is just what i was looking for!. Regarding security issues my first option was port forwarding on the router. But as i understood this had even worse security implications and also problems with the company that the LAN belongs to regarding changing their router configurations. – Ethan May 31 '15 at 8:21

If you control the firewall you can use port-fowarding on it to avoid the use of a reverse-ssh (it will be more stable).

| improve this answer | |
  • But open to everyone. – Thorbjørn Ravn Andersen May 31 '15 at 11:43
  • Yes this was my first idea but the company that owns the LAN does not want us playing with their router configuration. – Ethan Jun 5 '15 at 10:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.