grm blog. Work is copyrighted unless otherwise stated.
2023-03-31 Fri
^

VPS as an ssh jumphost

My ISP uses a Carrier-grade NAT for home customers which leaves me with an IP that is shared with many others and thus I can't connect to my network from the outside.

Ssh reverse tunnel can be used to remedy that and restore outside ssh connections to my home comuter.

Requirements

Here is what you need:

  • ssh server on the home computer listening on <LOCAL_PORT>
  • an ssh enabled VPS listening on <VPS_PORT>
  • an availiable port on the VPS <JUMP_PORT>

Configure the vps in .ssh/config

Host vps
Hostname my.vps.com
User vps_user
Port <VPS_PORT>

Then start the reverse tunnel from the home computer

ssh -o ServerAliveInterval=60 -vNR <JUMP_PORT>:localhost:<LOCAL_PORT> vps

You can redirect the output of the reverse tunnel to a logfile since it has some usefull information.

Finally, to connect to the home computer you can do this:

ssh -AJvps home_user@localhost -p<JUMP_PORT>

Explanation

The -R handles the reverse tunnel, instructing the VPS to listen on the localhost:<JUMP_PORT> and forward the connections via the reverse tunnel in <LOCAL_PORT> in the home computer.

Thus, to connect you need to:

  • -A forward ssh agent (optional to handle the ssh keys)
  • -J use vps as the jumphost
  • home_user@localhost -p<JUMP_PORT> connect in the localhost (vps) as home_user via the <JUMP_PORT> thus initiating an ssh connection through the reverse tunnel.