Setting up a bastion host to access local machine

Question

My ISP gives me a 192.168.* IP to my home router. Only the main company router in the building gets a real IPv4 IP but all of the tenants in the building share that. They don't do IP forwarding so I can't request port 22 to be forwarded just to me or anything like that.

Using Tor, I can open a route to the Tor network and ssh in from the outside. However, it is very laggy as you can image. Similarly, my Synology NAS opens a route to a remote server at Synology and I can connect to it remotely.

I would like to know what this transport system is called and how I can use it to connect my home machine to a VPS server that I already lease (aka my bastion host) so that I can ssh in remotely, via the bastion host, without needing to go through Tor. I love Tor, but the lag over ssh makes me crazy.

Answer 1

I've did the exact same thing recently to connect to IoT devices connected on the Internet with mobile network and therefore under NAT.

My solution is based on a micro-instance on Google Cloud. Its IP must be permanent, let's call it server_ip. No firewall rules seem needed.

On your local device, that one that you'd like to connect remotely, run:

ssh -N -R 5757:localhost:22 <server_ip>

where 5757 is the listening port that will be opened on the server (it could be anything but grater than 1023). This instruct the server to

On the end-device, e.g. on your laptop when you're away from home, run:

ssh -J <server_ip> -p 5757 localhost

this will connect you via jump host, routing the ssh connection directly to the opened connection from your home device.

To make everything more secure and smoother, I suggest you to use SSH key-based authentications, both in the server and in your home device. If you need further assistance, please comment.

---

As a final note, the first command (ssh -N -R 5757:localhost:22 <server_ip>) must not be quit, therefore you have to run it with nohup or through a service. The latter solution is that one that I prefer, here is my service file:

[Unit]
Description=Reverse SSH to GCL on port 5757
After=network.target

[Service]
Type=simple
User=flynn
ExecStart=/usr/bin/ssh -N -R 5757:localhost:22 <server_ip>
Restart=always
StartLimitInterval=30

[Install]
WantedBy=multi-user.target