3

I have 2 Servers and the network looks like this:

Server_A (Ubuntu) -> Firewall/Router -> Internet

Server_A can connect to any server on the internet.

Server_B (Ubuntu) which is directly connected to the internet.

No restrictions in port forwarding or any Firewalls on Server_B

I can't connect to Server_A from the internet because it is inside a local network and port forwarding is not possible here, I don't have access to the router.

Can Server_A connect to Server_B so I can connect via SSH to Server_B and communicate with Server_A?

3
  • Does Server_A have an ssh server running?
    – kmkaplan
    Jan 20, 2017 at 16:40
  • I would suggest you take a few minutes to talk to the one who manages Server_A's router or you could otherwise open considerable security risks to your organization with any solution that would allow your request to pass. That could get you fired on the spot from any place where I've worked. Jan 20, 2017 at 16:42
  • There is indeed several situations in which technically one would be requested to bypass a router.
    – Brethlosze
    Jun 19, 2017 at 2:46

2 Answers 2

3

If you can run a ssh server on Server_A, the you can ssh from Server_A to Server_B and have a port on Server_B forwarded back to Server_A's ssh server.

Server_A$ ssh -R 12345:localhost:22 Server_B
Password:
Server_B$ 

And then on Server_B you can now ssh to Server_A by using localhost on port 12345:

Server_B$ ssh -p 12345 localhost
Password:
Server_A$

If you really want to expose Server_A's ssh server on the Internet you can make the port forwarding accessible from other hosts, but this requires that Server_B's sshd_config file allows GatewayPorts:

Server_A$ ssh -R '*:12345:localhost:22' Server_B
Password:
Server_B$ 

and then from anywhere:

Anywhere$ ssh -p 12345 Server_B
Password:
Server_A$

But as mentionned in a comment be very careful you do not step over some important security policies.

2
  • thank you! it works :) I used the first method. And needed to change localhost to 127.0.0.1 becase I got this error: "ssh connect_to localhost: unknown host (Name or service not known)"
    – MilMike
    Jan 20, 2017 at 17:20
  • ssh -nNT -R 12345:localhost:22 Server_B if just want a tunnel. Jun 26, 2017 at 12:11
1

Consider using Teredo(Miredo in OpenSource world). Following paragraph is an excerpt copied shamelessly from Wikipedia.

In computer networking, Teredo is a transition technology that gives full IPv6 connectivity for IPv6-capable hosts that are on the IPv4 Internet but have no native connection to an IPv6 network. Unlike similar protocols, it can perform its function even from behind network address translation (NAT) devices such as home routers.

Once the server is up and running, Teredo client will automatically connect to relay server and get an routable IPv6 address. This IPv6 address can be static or dynamic (depending on Teredo relay/server). You can even make a dynamic DNS update if required.

This will give you seamless bi-directional connectivity between your server and clients without resorting to port forwarding. You may have to address the security concerns by restricting the access to IPv6 address using PKI infrastructure.

2
  • This is not a bad suggestion but it implies that the servers already have IPv6 support which is far from certain. A similar IPv4 tool would be preferable. Jan 20, 2017 at 16:36
  • You are right. Unfortunately, there are no IPv4 options like this consider they are scarce.
    – fossil
    Jan 20, 2017 at 16:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .