Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a router that provides internet connection to a single client device via a wireless cellular data network. This network provides non-public IP addresses which gets natted. I would like to get a static IP address outside of the network that will route everything back to the device on the cell network.

Because this is an embedded device, space is limited (about 500kB to work with here). Because the network is expensive, it has to not consume too much traffic.

First I tried creating an IPIP tunnel using iproute2. From the server, I used the router's egress IP for the remote IP, not the private address the router received. I hoped that once the router communicated over the tunnel to the server, the server could communicate back. This was not the case.

I tried dropbear SSH and found it won't do a generic tunnel, but I thought I could probably get around that using iptables. However, it seems that just having the ssh link open consumes about 150 bytes/sec.

I also tried nc, but the communication is only one direction, so I can initiate a connection to the server, but can't get anything back.

OpenSSH and OpenVPN are too big to fit on the device (both around 1MB).

My next attempt will probably be to write a program that keeps a persistent socket open to the server, and to use iptables to route the traffic to that program. I wanted to see if there were any other ideas first.

So, any ideas?

share|improve this question
up vote 4 down vote accepted

The only NAT that an IPIP tunnel might work with is one-to-one NAT, which is clearly not what you have in the cellular case.

This "150 bytes/second for an open SSH connection" business is very strange and you should investigate. No such thing happens for me with OpenSSH -> OpenSSH sessions (there's the unavoidable keepalives, but you actually WANT those when you're behind a NAT) and there's no reason it should unless you're actually passing traffic.

You are mistaken about netcat being unidirectional, a TCP session initiated with netcat works both ways.

I would suggest getting a bidirectional stream up any way you can (probably netcat and a TCP listener on the server) and running PPP over that. You get all the usual disadvantages of running IP over TCP, but it's better than not having connectivity at all.

Here's what works for me in a quick test - on the server:

server:~$ sudo pppd noauth passive pty "nc -lp 9999" debug nodetach

On the client:

client:~$ sudo pppd noauth pty "nc server 9999" debug nodetach

I think having dialup semantics also provides a useful model for the cases where your cell device will simply not be reachable.

After you have the IP connection running, you can consider playing IPIP or 1:1 NAT.

share|improve this answer
Thanks! The pppd was a great idea - I set up xinetd to launch pppd on the server. Now I can even support multiple clients. – Shawn J. Goff Nov 22 '10 at 23:07

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.