LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 10-24-2013, 05:04 AM   #1
vib150
LQ Newbie
 
Registered: Oct 2013
Posts: 11

Rep: Reputation: Disabled
ssh reverse tunnel


Hi!
This is my scenario:
Machine A ---->router TP-LINK with openwrt ----> machine B
Should I be able to open a ssh reverse tunnel from Machine A to Machine B through router TP-LINK? And if yes, how could I do it?
I've tried many tutorials, and I think it's time to start from scratch.
Both machines are debian/ubuntu.
TP-LINK TL-WR1043ND with:
Firmware Version OpenWrt Attitude Adjustment 12.09-beta2 / LuCI 0.11 Branch (0.11+svn9402)
kernel version 3.3.8
Thank you very much in advance.
 
Old 10-24-2013, 05:39 AM   #2
pan64
LQ Addict
 
Registered: Mar 2012
Location: Hungary
Distribution: debian/ubuntu/suse ...
Posts: 21,850

Rep: Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309
what is the goal? Probably you only need port forwarding.
 
1 members found this post helpful.
Old 10-24-2013, 06:01 AM   #3
vib150
LQ Newbie
 
Registered: Oct 2013
Posts: 11

Original Poster
Rep: Reputation: Disabled
The goal is to have access to the machine A which is behind a router DHCP.
 
Old 10-24-2013, 06:05 AM   #4
pan64
LQ Addict
 
Registered: Mar 2012
Location: Hungary
Distribution: debian/ubuntu/suse ...
Posts: 21,850

Rep: Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309
yes, port forwarding is enough, you will need to setup your router to forward a port to that given host. And you will reach your host by ssh to the routerort. You can also use www.no-ip.com to configure a hostname to your router, openwrt can handle it too.
 
Old 10-24-2013, 06:25 AM   #5
vib150
LQ Newbie
 
Registered: Oct 2013
Posts: 11

Original Poster
Rep: Reputation: Disabled
I'm very sorry. I guess I made myself a kind of confusing. I apologize for that.
Machine A is in "foreign" network behind a router (BTW I got the network owner permission). I own machine A so I can configure it. Machine A connects with the openwrt router automatically. Opernwrt router has already no-ip service installed. The problem is that I can not open a ssh reverse tunnel from machine A to machine B, the openwrt router. I've opened a port (2020) on OW router and forwarded to machine B. But when I try to open the reverse tunnel, the router answer that connection refused on port 22 ( I don't use that port).

Thanks again for your time.
 
Old 10-24-2013, 06:31 AM   #6
pan64
LQ Addict
 
Registered: Mar 2012
Location: Hungary
Distribution: debian/ubuntu/suse ...
Posts: 21,850

Rep: Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309
So Machine A is in foreign network and behind a router and Machine B is on the local network of your OW router?
You can reach your OW router from A and therefore you will be able to reach B from A.
In this case please try this setup: http://www.howtoforge.com/reverse-ssh-tunneling
(Destination is A and client is B)
 
1 members found this post helpful.
Old 10-24-2013, 10:24 AM   #7
vib150
LQ Newbie
 
Registered: Oct 2013
Posts: 11

Original Poster
Rep: Reputation: Disabled
First of all, Thank you very much for your help.
Now I open a reverse tunnel from machine A to the OW and when I "ssh localhost -p port" on OW nothing happens, I mean there is no machine A prompt.
 
Old 10-24-2013, 11:45 AM   #8
pan64
LQ Addict
 
Registered: Mar 2012
Location: Hungary
Distribution: debian/ubuntu/suse ...
Posts: 21,850

Rep: Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309
Have you configured your OW to forward that port to B?
 
Old 10-24-2013, 11:48 AM   #9
vib150
LQ Newbie
 
Registered: Oct 2013
Posts: 11

Original Poster
Rep: Reputation: Disabled
how should I do it?
 
Old 10-24-2013, 11:54 AM   #10
pan64
LQ Addict
 
Registered: Mar 2012
Location: Hungary
Distribution: debian/ubuntu/suse ...
Posts: 21,850

Rep: Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309
There is a NAT/QoS tab and Port forwarding (that is inside the menu of OW). You need to set port from (that is the external port, will be accessed from A) IP address is the address of B, port to is the port on B where the ssh connection is accepted (usually 22, but you can configure it if you want to do so).
 
Old 10-24-2013, 11:58 PM   #11
vib150
LQ Newbie
 
Registered: Oct 2013
Posts: 11

Original Poster
Rep: Reputation: Disabled
Well here is where I'm stuck with:
machine A open reverse tunnel to machine B (port forwarded on OW router)
machine B is listening on port forwarded to machine A.
When ssh from machine B to machine A, here the log in both machines.
Machine B:
OpenSSH_5.9p1 Debian-5ubuntu1.1, OpenSSL 1.0.1 14 Mar 2012
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to 192.168.2.80 [192.168.2.80] port 10000.
debug1: Connection established.
debug1: identity file /home/vib150/.ssh/id_rsa type -1
debug1: identity file /home/vib150/.ssh/id_rsa-cert type -1
debug1: identity file /home/vib150/.ssh/id_dsa type -1
debug1: identity file /home/vib150/.ssh/id_dsa-cert type -1
debug1: identity file /home/vib150/.ssh/id_ecdsa type -1
debug1: identity file /home/vib150/.ssh/id_ecdsa-cert type -1
ssh_exchange_identification: Connection closed by remote host
machine A:
debug1: remote forward success for: listen 10000, connect localhost:2030
debug1: All remote forwarding requests processed
debug1: client_input_channel_open: ctype forwarded-tcpip rchan 1 win 2097152 max 32768
debug1: client_request_forwarded_tcpip: listen 0 port 10000, originator 192.168.2.65 port 51571
debug2: fd 4 setting O_NONBLOCK
debug1: connect_next: host localhost ([127.0.0.1]:2030) in progress, fd=4
debug2: fd 4 setting TCP_NODELAY
debug3: fd 4 is O_NONBLOCK
debug3: fd 4 is O_NONBLOCK
debug1: channel 0: new [192.168.2.65]
debug1: confirm forwarded-tcpip
debug3: channel 0: waiting for connection
debug1: channel 0: connection failed: Connection timed out
connect_to localhost port 2030: failed.
debug2: channel 0: zombie
debug2: channel 0: garbage collecting
debug1: channel 0: free: 192.168.2.65, nchannels 1
debug3: channel 0: status: The following connections are open:
 
Old 10-25-2013, 12:18 AM   #12
pan64
LQ Addict
 
Registered: Mar 2012
Location: Hungary
Distribution: debian/ubuntu/suse ...
Posts: 21,850

Rep: Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309
so reverse tunnel is surely opened. in that case ssh localhost -p port should work. I cannot say now anything else because you did not tell us what have you executed, how did you check the tunnel and other things. I have no idea where the ip 192.168.2.80 belongs to. Also which ports did you use for forwarding and tunneling...
 
Old 10-25-2013, 02:51 AM   #13
vib150
LQ Newbie
 
Registered: Oct 2013
Posts: 11

Original Poster
Rep: Reputation: Disabled
That's the whole schema:
machine A:
ssh port 2030
command:
ssh -p62830 -o StrictHostKeyChecking=no -nNT -g -R 0:10000:127.0.0.1:2030 myuser@my_no-ip_address

OW router:
Port 62830 forwarded to machine B (192.168.2.80)

Machine B:
ssh port 62830

I use the flag -vvv on machine A and B ssh commands (the final output is in my last post, I can paste more if needed)
I check the port 10000 listening on machine B with command:
netstat -na|grep 10000
and its output is:
tcp 0 0 0.0.0.0:10000 0.0.0.0:* LISTEN
Command on machine B to connect with machine A through the port 10000:
ssh myuser@localhost -p 10000
and now the netstat shows:
tcp 0 0 0.0.0.0:10000 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:39258 127.0.0.1:10000 ESTABLISHED
tcp 0 0 127.0.0.1:10000 127.0.0.1:39258 ESTABLISHED
and after more or less 20 sec the verbose log shows what I pasted on my last post.

Please, tell if you need anything else.
 
Old 10-25-2013, 03:08 AM   #14
vib150
LQ Newbie
 
Registered: Oct 2013
Posts: 11

Original Poster
Rep: Reputation: Disabled
BTW. I use use password for authentication
 
Old 10-25-2013, 03:31 AM   #15
pan64
LQ Addict
 
Registered: Mar 2012
Location: Hungary
Distribution: debian/ubuntu/suse ...
Posts: 21,850

Rep: Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309Reputation: 7309
a simple ssh -p <port on OW> user@<ip of OW> will check if port forwarding works (without -R you should be able to login).
I do not really understand your ssh command, especially what is given in -R.
ssh -p <port on OW> -R <listening port on B>:<ip of A>:<ssh listening port on A> username@<ip of OW>
<port on OW> should be forwarded to B.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Shell a/c for Reverse-SSH-Tunnel - is the right choice? \/4A Linux - Networking 2 02-03-2013 06:52 AM
rsync via reverse ssh tunnel dexznrl Linux - Software 1 02-08-2011 08:38 AM
[SOLVED] Reverse SSH tunnel edan Linux - Security 3 07-14-2010 09:37 PM
SSH reverse tunnel (lo only? why not eth0) Dinomight Linux - Networking 3 08-17-2006 09:44 PM
Reverse SSH Tunnel sniggleflop Linux - Security 1 10-13-2002 01:24 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 10:20 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration