Creating a ssh config for a reverse tunnel + local forward

Question

I'm trying to create a ~/.ssh/config entry for the following scenario:

I have a linux box in a private network somewhere, a vps server which is accessible from anywhere and my local macbook.

The linux box is behind firewalls but I should still be able to SSH into the box from my local macbook.

---

My current solution which works is the following:

The linux box starts a reverse tunnel to the vps via:

ssh -R 15000:localhost:22 vps-user@vps

and then from my local macbook I start a tunnel to the vps via:

ssh -L 12345:localhost:1500 vps-user@vps

and then I start another ssh command from where I can directly ssh into the linux box which would else be hidden behind firewals etc.:

ssh linuxbox-user@localhost -p 12345

---

So first of all, this all works pretty reliably (if you have any easier way to do this, let me know - it seems pretty cumbersome on the macbook side).

How would I create a ~/.ssh/config entry to, in the best case scenario, just write:

ssh linuxbox

and be done with it?

I've tried using the LocalForward option, which allows me to atleast make an alias for the ssh -L ... command but it still requires the second ssh command.

I've also tried the ProxyCommand option but to no luck, maybe just wrong configuration?

Answer 1

The easiest way is probably to avoid the local forwarding, that appears unnecessary in your case, and leverage the ProxyJump directive, which lets you specify one or more jump proxies (i.e. one or more intermediate host(s) you connect to and from which you reach your target host).

You will need two connections:

1. The remote forwarding you are already establishing, from your linux box to the vps:

   ssh -R 15000:localhost:22 vps-user@vps
   

   I'm assuming that you can connect to the vps on port 22 (as it seems implied in your question).
   This will let the vps forward connections it receives on port 15000 to port 22 of your linux box.

2. A connection from your local MacBook to the vps:

   ssh -J vps-user@vps -p 15000 linuxbox-user@localhost
   

   -J is a shortcut to specify a ProxyJump directive (refer to the manual page for ssh(1)).
   Again, it is implied that you can connect to the vps on port 22.
   This command will connect your local MacBook to port 22 on the vps and, from there, to port 15000 on the same vps (where the linux box is listening), giving you a login to your linux box with no further connections needed.

The corresponding .ssh/config files would be:

• On your linux box:

  Host vps
      RemoteForward 15000 localhost:22
      User          vps-user
  

  Which allows you to just type:

  ssh vps
  

• On your local MacBook:

  Host linuxbox
      ProxyJump vps-user@vps
      Hostname  localhost
      Port      15000
      User      linuxbox-user
  

  Which leaves you with the need to just issue:

  ssh linuxbox
  

If you are using public key authentication (as you are presumably doing, at least to allow the unattended setup of the remote forwarding), you can also add the IdentityFile directive to both your .ssh/config files to remove the need for typing passwords.

---

If some conditions are met, you might also be able to directly connect your local MacBook to port 15000 on the vps, avoiding the need for local forwarding or a proxy jump. Namely, the conditions are:

1. Port 15000 on the vps is not filtered by a firewall.

2. You set GatewayPorts yes in sshd's configuration on the vps (usually in /etc/ssh/sshd_config).
   This setting defaults to no and determines if remote forwarding can bind a listening port to other addresses than the loopback one (hence, an IP address that is not 127.0.0.1 or ::1). Refer to the manual page sshd_config(5) for further information.

In this scenario, you would just need these two commands:

1. The reverse forwarding from your linux box to the vps (note the *: preceding the remote port, which stands for "listen on any address"):

   ssh -R *:15000:localhost:22 vps-user@vps
   

2. A simple connection from your MacBook to the vps:

   ssh -p 15000 -l linuxbox-user vps
   

Which translate into the following .ssh/config files:

• On your linux box (again, note the *: preceding the remote port):

  Host vps
      RemoteForward *:15000 localhost:22
      User          vps-user
  

• On your local MacBook:

  Host linuxbox
      Hostname  vps
      Port      15000
      User      linuxbox-user
  

Note, however, that this way you will expose your linux box to the internet, which most likely is something you don't want.

Answer 2

I assume the Linux box executes the reverse tunnel to the VPS automatically, because if you could do it from the macbook this would not be necessary.

So all you would have to do on the macbook is:

• write a bash script:

  #!/bin/bash
  ssh -f -N -L 12345:localhost:1500 vps-user@vps
  sleep 5
  ssh -f -N linuxbox-user@localhost -p 12345
  

• Make sure it is executable chmod +x /path/to/script

• Then create a alias at the end of /home/username/.bashrc

  alias sshlinuxbox="/path/to/script"
  

• Then all you have to do is, type sshlinuxbox after opening a new terminal to refresh from the .bashrc.

Answer 3

This line is correct, but confusing:

2. A simple connection from your MacBook to the vps:

ssh -p 15000 -l linuxbox-user vps

"-l" is login name, something not used much with ssh

An even easier command is this:

ssh -p 15000 linuxbox-user@vps

Explanation: The "linuxbox" had its connection forwarded to port 15000 on the vps server when it was connected with the reverse ssh connection (type R). Now with the laptop accessing the "linuxbox" at the vps server, the laptop needs to address the linuxbox-user at the vps server. Hence linuxbox-user@vps.

Also, if you make a connection and your remote linuxbox is expecting a password, you will get a prompt: linxubox-user@vps's password: At that point you need to actually enter the linuxbox-users password.