4

My office has one default gateway and behind that is a local network with locally assigned IP addresses to all computers including mine.

I hold admin in my Ubuntu installed office PC and is it essential that I access the computer during weekends through SSH.

At office, I do not have a public IP but I always get the same local IP from the DHCP. I'm free to set up any software I like in my pc although I cannot set up port forwarding in the main firewall.

I get a public IP to my home computer which also runs Linux. please note I cannot install Team Viewer-like software.

How can I solve my problem?

Denis
  • 202
  • 1
  • 3
  • 11

2 Answers2

6

It's easy:

  1. [execute from office machine] Setup connection Office -> Home (as Home has public IP). This will setup reverse tunnel from your office machine to home.

    ssh -CNR 19999:localhost:22 homeuser@home

  2. [execute from home machine] Connect to your office from home. This will use tunnel from the step 1.

    ssh -p 19999 officeuser@home

Please ensure, that ssh tunneling is not against your company policies, cause sometimes you can get fired for such connection schema (e.g. my employer will fire me for that).

ps. In the first step you may want to use autossh or something like that, so your tunnel connection will be automatically restored in case of unstable network.

rush
  • 27,055
  • 7
  • 87
  • 112
  • 1
    +1 I think the part about company policy should be in bold. Oh but if they allow outgoing encrypted communications, then probably he does nothing wrong :) – Marki Nov 16 '14 at 14:32
  • this is under their request, so I think i'm safe. And SSH is such a sophisticated software. I didn't know it could do this. many thanks for the answers and your concerns. Im going to try this and I will comment the results here. – Denis Nov 16 '14 at 16:33
  • I ran the command: ssh -CNR 19999:localhost:22 -i privateKey.pem homeuser@homeIP while i was at office. Its seems the whole terminal is stuck. What could be the possible problem? – Denis Nov 18 '14 at 15:17
  • `-N` option tells ssh do not perform actual login and it will just open tunnel and hand till disconnected with ^c or network issue – rush Nov 18 '14 at 15:26
  • In the same way. autossh is wrapper for ssh which is able automatically restore connection in case of connectivity lost. – rush Nov 18 '14 at 16:19
  • I would like to add another method I found. I sshed to my Amazon server which is always in "on" state using ssh -NCR 19999:localhost:22 amazonAWSuser@AmazonServerIP from office. Afterwards I sshed to my Amazon server the usual way from home. Then typed ssh -p 19999 -i key.pem [email protected] It worked! The advantage of this method is that I dont have to worry about my home IP changes. @rush if there is something wrong with this method, please highlight. – Denis Nov 18 '14 at 16:48
1

Assuming that you have control over your home network, and that there you setup your internal IP address fixed (e.g. based on the MAC address of your home PC), then you can open up a port (e.g. 4321) on your home router to forward to your PC also on 4321.

At home make sshd listen on that port.

Create a new user locally as you (of course) don't want to use your normal public/private key-pair to run on your office computer while you are not there. Create a public/private keypair on your office computer and copy the public key over to the new user on you home computer.

Assuming that your home IP (as given by your provider to your router) is relatively stable, and that you can have some place to publish this home IP address (e.g. by uploading it to some web site), where your office PC, can retrieve it, then your office PC can set up a reverse ssh tunnel.

Your office PC should retrieve the home IP on a regular basis (e.g. every 5 minutes) and if the IP has changed set up the reverse ssh tunnel:

ssh -p 4321 -N -R 12345:localhost:22 reverse@home-ip

and you can connect to the local port 12345 with ssh to connect to your office PC:

ssh -p 12345 officelogin@localhost
Anthon
  • 78,313
  • 42
  • 165
  • 222
  • There is no `-P` option in ssh. `$ man -P 'cat' ssh | grep -- -P | wc -l # --> 0` – rush Nov 16 '14 at 10:47
  • @rush typo, thanx – Anthon Nov 16 '14 at 11:01
  • I ran ssh -p 19999 12345:localhost:22 homeuser@homeIP from my office and also changed the sshd_config to listen on port 19999. I receive an error called Could not resolve hostname 12345:localhost:22: Name or servce not known. Would you please help – Denis Nov 18 '14 at 15:44
  • @QwertyCoolGuy There was a `-N -R` missing from the command, that is why `123...` got interpreted as the target (it is an option to `-R`) – Anthon Nov 18 '14 at 16:06