Spanish version: https://medium.com/@rretamal.dev/creando-un-t%C3%BAnel-ssh-inverso-8634f84c9655
On some occasions is necessary to connect to a computer remotely, depending on the case those devices can work behind a firewall or a NAT that prevent you to connect without do all the necessary configurations to do a port redirection or you can’t use a VPN or don’t have the time to configure it.
TeamViewer is a tool that helps in many of those cases but at least on this opportunity I had to connect a non-GUI device so in order to make the application work I have to configure a fake display with X.Org that gave me a number of troubles so I decided to create a reverse tunnel.
The idea behind this is that your destiny machine is going to be connected with a server and your client machine is going to connect to that server and from there is going to connect to the final device.
Perhaps is easier to see with a little diagram (sorry I’m not a designer but here it goes):
So because I was needing to test fast and cheap I decided to use portmap.io so to begin to work with this you have to create an account using a login, an email and a password (requires email confirmation):
Next, you will see a screen where you have to select the Configuration option:
When you see the next screen you have to select the option “Create New Configuration”.
So on the Configuration you have to put a name to your new configuration, like “First Tunnel” for example, the type of the tunnel, for this example I used the SSH option and next you have to generate a private key, for that you have to select the “Generate” option, this is going to generate the key and you can to download the private key file or copy the text.
You have to save the private key on the computer that you want to connect, on the page there is a suggested folder for the file in “~/.ssh”, so for this example we are going to use it, next you have to give permissions to access the file so we can use it, to do that execute the following command:
chmod 600 /.ssh/tuarchivo.pem
So perfect, we have the account, the configuration and our private key saved, so the next step is to create the port redirection rule, so you have to go to “Mapping Rules” and you will see this screen:
On this screen select the “Create new Rule” option and there you have to indicate the following:
- The created configuration.
- The protocol that we want to use, for this case is TCP.
- The hostname and the domain, you can change that or just use the suggested info.
- A default port to make the connection (we are going to keep it).
- The port that you want to connect on the remote computer, on this example I was planning to do an ssh connection so I put the 22 port.
- Last you have to indicate the IPs that will have access to do the connection to the remote device, if you keep it empty any computer with the address and credentials could enter the device.
So with the configurations and the port mapping you have to go to your destiny machine and execute the tunnel command (there is an example when you create the mapping):
ssh -i /.ssh/ricardoejemplo.pem ricardo.first@ricardoejemplo–52452.portmap.host -N -R 52452:localhost:22
And boom! Exploded! nahhh you have the tunnel active. So now you can go to your client machine, that is any device outside the network and try the connection, on Windows you can use Putty:
You will have to confirm the private key trust and if the connection worked you will see a prompt like the following where you have to indicate the credentials of the device:
Once you have entered the credentials you are connected to the computer!
From here you can manage and do what you have to do with the remote computer.
Hope this small guide will be helpful.
Regards!