I have a linux machine that I'd like to be able to access remotely for SSH, FTP, HTTP, and so forth. I signed up for Dynamic DNS with No-IP.com, but this isn't adequate because I am on a college campus network, behind an NAT, and don't have permission to access the router to set up port forwarding. I don't know if the campus routers support UPnP or NAT-PMP but I doubt it.

Anyways, I was wondering if there was a way to get around this using a VPN. I know that a VPN would allow me to, for instance, access my linux box from my laptop if I had the VPN software installed on both machines. But I'd like to be able to access my linux box from any computer, without having to install software. Or at the very least be able to access the HTTP part that way. And while I know that many VPN services offer web interfaces for file transfer, etc., I'd rather be able to access my linux box using regular FTP and SSH client software.

Anyways, is this something you can do with a VPN? Or is there a way to chain a VPN with Dynamic DNS somehow? I looked at the website for Hamachi VPN, but it described all the features in nontechnical terms, so I wasn't able to figure out these questions and I'd prefer to know before creating an account.

  • do you know if your university firewalls allowing any traffic to be forwarded to a student/enduser machine ? Usually, in public environments, end user workstations can only be initiators of the communication, not the end point, i.e. a server role. Usually universities or corporations, do not allow (without a good reason and approval from a person in charge) to let an outside user, access an internal end user's workstation. If your situation is different, more power to you, but if it is so, you do not have a prayer. Sorry.. – MelBurslan Dec 5 '12 at 17:40
  • You may use Tor network: torproject.org/index.html.en that allows you to host services behind NAT, requiring a client. – week Dec 5 '12 at 18:04

From the sound of it, your campus firewall doesn't allow any connection to be initiated from outside the campus to your machine. So in order to connect to your machine you'll have to initiate the connection from the inside.

So you'll have to establish some connection between your dorm machine D and some external machine E outside the campus. Then, when you want to connect to your dorm machine from some client C, connect to E instead and set up E so that it will relay the connection.

For the D→E connection, you can use a VPN. This requires root-level access on both D and E. A VPN gives IP connectivity between D and E, so from C you will be able to access any network service on D that E is willing to route between C and D.

A lighter-weight solution is to establish an SSH connection from D and E, which only requires a shell account on both sides (and E must allow SSH, of course). From D, run

ssh -R 2242:localhost:22 E sleep 999999999

This creates a port forwarding from E to D: any connection made with E on port 2242 is relayed to D on port 22. Port 22 is the ssh port, so when you run ssh -p 2242 E, this connects you to D, where you can log in. To automate this, you can define an alias in ~/.ssh/config like the following (PuTTY has similar settings, consult its manual):

Host dorm
UserName bob
HostName E
Port 2242

You can route multiple ports that way. For example, to also relay port 8042 on E to port 80 on D:

ssh -R 2242:localhost:22 -R 8042:localhost:80 E sleep 999999999

You'll need to re-run that command every time your network connection starts on D.


If you have a machine that is not behind NAT (i.e. freely accesible from the internet), you can ssh into it from the machine on campus and forward arbitrary remote ports to the appropriate local (on the campus machine) ports through that ssh session - the option for OpenSSH is -R. You would then connect to the forwarded port on the non-NATed machine and the ssh from the campus computer would tunnel the data through the campus NAT. A bit clumsy, but it works.


A VPN can solve this, yes.

Specifically, you'll need a VPN that allows port-forwarding. I only have experience with Mullvad and they do this, but I'm sure many other VPNs also provide this.

With most services you probably cannot expect to forward arbitrary ports (22 for ssh for example), so you'd have to use some "random" high-number port. But configuring ssh/ftp for this should be very simple.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.