I have vpn set up in two different countries A (primary, where I live) and B (secondary, which I visit once or twice a year) and would like to SSH to my devices across the vpn.

My Setup:

  • Country A:

    • adsl2 modem in bridge mode > Dedicated Pfsense box (acting as dhcp server and firewall and has openvpn configured from purevpn)
    • ASUS Wireless router in AP mode
    • Gigabit switch
    • rest of the network which consists of various devices including a Pi running Tor relay and a wireless camera.
  • Country B:

    • Adsl 2 modem not in bridge mode
    • Linksys e1200 AP (flashed with dd-wrt and configured with openvpn using my purevpn account)
    • Pi running tor relay and IP cam connected via wifi. I Also have a wireless range extender just in case.

What I already know:

My VPN provider needs to give me a dedicated IP which I will get shortly before I travel to country B in a month.

What I'm confused about:

Will I need to forward relevant ports on firewalls on both sides for each client/machine individually?

What I need to know:

  1. Is this set up possible? I SSH into my clients regularly over LAN but it would be sweet if I could check out how my relays and cameras are doing from another country.

2.The setup in country A is working and tested but I won't be visiting country B till next month. Am I using the right configurations for Country B with respect to hardware and general setup? I can't test it untill I get there and I won't be able to buy additional parts when I am there.

P.S More info: I have static WAN IPs provided by the ISP in both countries.


First, I'm somewhat confused why, having static IPs, you don't just VPN directly to those boxes, instead of connect over your VPN provider. You could then just route the traffic, and not need any NAT between your remote client and either of the LANs. (I guess maybe you're doing this for privacy, only reason I can come up with. Of course, if your VPN provider sets up static IPs for you, that seems to somewhat defeat the privacy.)

Regardless of that, you'll need to set up firewall rules at each firewall, and port forwards at each NAT. In your A setup, it sounds like that's only the pfsense box; in your B setup, it sounds like that's only the E1200 AP. (The ADSL modem might be too, but you're already bypassing that by going over the VPN which terminates on the E1200).

So, for example, if you configure the pfsense A box to forward vpn-ip:2222 to pi-lan-ip:22, and configure its firewall to allow traffic from the vpn to the pi on port 22, you should then be able to ssh -p 2222 vpn-ip and get to the pi.

Another option, if you're going for privacy, is presumably to have your Pis run sshd as a Tor hidden service. (I've never really played with Tor, so I can't help much on the setup here.)

I suggest that you confirm all your passwords are secure before enabling this, and additionally seriously consider disabling password authentication (in your sshd configs) entirely.

  • Yes it is im using the VPN because Im going to be running exit relays on the tor network. The VPN IP even though is dedicated wont be anywhere near my physical locations so that not a worry. P.S not doing anything illegal just trying to set up these small servers then slowly move on to bigger things. Rpis are great for learning IMO – Hani Umer Jun 5 '15 at 20:56
  • I meant to say Yes it is for privacy..typo – Hani Umer Jun 5 '15 at 21:12
  • @HaniUmer There are plenty of reasons to want privacy besides lawbreaking. Anyway, you'll also want to keep in mind that the ssh host keys will identify those machines regardless of the IP address. Identify as in "that's the probably the same machine at IP A and IP B. Or at least controlled by the same person." – derobert Jun 5 '15 at 21:58
  • I always generate new hostkeys after installing ssh on my machines and replacing the default keys. Does that provide some security? If someone government type organisation is out to get someone there wouldn't be any hiding but I just need the privacy to not get tracked and do my thing not causing trouble lol. – Hani Umer Jun 6 '15 at 2:13
  • @HaniUmer Unique host keys ought to be generated as part of the install. The privacy risk is that the machine uses the same keys regardless of the network path to it. So, e.g., if you accidentally forwarded ssh from the WAN as well as VPN, someone could easily tell those two IPs are the same machine. Or if you later decide to switch to a Tor service. – derobert Jun 6 '15 at 2:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.