This question already has an answer here:

I have the following setup:

enter image description here

I would like to be able to ssh or vnc from home computer to work computer. I think that I could setup some permanent ssh (reverse) tunnel to get this all going, but I am not sure how to make this work.

marked as duplicate by roaima, Thomas Dickey, chaos, don_crissti, cas Nov 25 '15 at 22:57

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 1
    Strikes me it would be much easier to run something like OpenVPN from the work machine to the home one. (Assuming you have port-forwarding capability on your home NAT/Router of course.) – roaima Nov 25 '15 at 19:09
  • Running any kind of network out from your work computer may be grounds for dismissal. If I were you I would think very carefully about any network connection not agreed with your line manager. If you've already done this then obviously this warning is irrelevant and un-necessary. – roaima Nov 25 '15 at 19:10
  • 1
    Thanks for the words of caution roaima. I am actually working for myself from a co-working space, so I am not planning on firing myself anytime soon :). I wanted this setup because I know my EC2 box is always running, whereas I don't have a computer always running at home. – stevejb Nov 25 '15 at 19:14
  • And, my use case is actually the reverse. I would like to access my work machine from non-work places. It has many more cores than my laptop. – stevejb Nov 25 '15 at 19:16
  • are you in complete control of your home setup? e.g. can you reconfigure or replace the external router? – Rui F Ribeiro Nov 25 '15 at 19:29

The actual ssh process is not complicated. If done as you want, you just create an account in the EC2 machine, and keep an ssh open with autossh from the work machine to the EC2 machine. Others have already pointed out the article you need, start autossh reverse tunnel automatically when network comes up

There are several disadvantages of diverting the traffic through the EC2 server. One of them is that you actually pay for usage and traffic in AWS, other is the slowness of using ssh connections tunnelled inside ssh connections, another is that it will be not impossible but cumbersome to tunnel UDP connections on top of the TCP ssh connections, and lastly the longer RTT involved in the packets travelling to the nearest AWS center and coming back.

You can also have legal issues into data or traffic from projects you are working leaving the national borders.

Another alternative is setting up in the home router a machine in the DMZ area, and for instance, accessing a www site in the EC2 machine that is visited every say 5 minutes by the work machine, the work machine will establish a connection to your IP address. (more in that later)

I also would prefer using IPsec or OpenVPN than ssh. I have had ssh for a while, and the process of having to correctly setup tunnels to access different services is tedious and cumbersome.

As for the IP address of your home machine. You do not need a static one, you have services like FreeDNS that give you a DNS entry that maps to the dynamic IP address the ISP gives you.

I have done actually here a different thing. I placed the ISP cable modem/router combo in bridge mode, and connected there a Raspberry PI compatible/Lamobo R1 with an wifi chipset, 5 ethernet gigabit interfaces, and a SATA port + SSD disk running Linux.


If you notice, this is a very interesting machine with a low power requirement.

I connect to home using an IPsec VPN based in StrongSwan to my dynamic IP address using a DNS name provided by FreeDNS.


The VPN is configured in such a way, that the native IPsec clients of my Macbook Pro and iPhone are able to connect to the VPN without installing any free additional software.

Once inside the VPN, and only inside the VPN (and at home) I have:

  • access to ssh,
    web server,
    HTML 5 videos,
    DLNA services,
    Voip services via asterisk w/ a trunk to my phone operator to allow me to make calls to any local operator that I use when abroad,
    BIND with RPZ, NTP, hostapd to give wifi to home.

I also have a switch chipset in that box, that separates two VLANs, the outside connection and the internal network.

In the rest of the ethernet ports, I connected my Smart TV and my Apple TV, so I can stream from any point at home to them.

My work machine is also configured to keep a permanent IPsec tunnel open to this home router, so I can log in anytime in it.

Link about permanent tunnel with StrongSwan:


Not the answer you're looking for? Browse other questions tagged or ask your own question.