On 12/19/2013 3:19 PM, Greg Freemyer wrote:

On Thu, Dec 19, 2013 at 5:51 PM, John Andersen wrote:

...

Friend's college age son wants to access his computer in the dorm when he visits home. College won't allow listening on ports, and they have him behind a NAT.

Is it possible to have an outbound (from the dorm) ssh connection "reversed" so that the target (the home computer) is able to control the dorm machine?

John,

The answer is use autossh. It is designed specifically to maintain a open port on a remote server. Then you just connect to the remote server and access the target PC.

--- details -- I do that at my Dad's house, but it does require a machine with a static IP somewhere.

In my case the PC at his place makes a outbound ssh connection to a server I control in the cloud. The type of ssh connection is a "tunnel" which causes the server in the cloud to open up a port and listen on it. That goes on 24x7x52. No software has to be installed on the cloud server. It just has to allow incoming ssh connections and have the alternate port open at the firewall.

Anytime I want to ssh into the PC at my Dad's I connect to the appropriate port on the cloud server and it forwards everything to PC at my Dad's.

When I first tried, I just had ssh with the reverse tunnel args called at boot time. I found out quickly that ssh is not very reliable if you are talking weeks/months.

Now I use autossh to manage the reverse tunnel for me. That is in the distro, so zypper in should get it for you.

I have it running with sysVinit still, so I just had to enable the daemon and edit the included config file.

Let me know if you go that route and you want to see any of my sysVinit scripts/config files.

Greg

Thanks Greg, this looks promising. You say:

...

In my case the PC at his place makes a outbound ssh connection to a server I control in the cloud.

So this "cloud" you refer to is any machine on which you can create a listening connection, so it could be some third machine somewhere, not yours, not your dads? -- _____________________________________ ---This space for rent--- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 12/19/2013 4:28 PM, Lew Wolfgang wrote:

There are ways to do this, but just because you "can" doesn't necessary mean you "should". I know of places where circumventing policy like this would earn you a security violation. You should ask the boy to find out what kind of penalties he might see if caught. Note that outbound persistent ssh connections are easy to spot by the organization's security team, even if you use non-standard ports.

Yeah, thought of this, but outbound they don't care about at all. You can run all the IMAP with idled connections and stream music all day long. They just don't want any publicly connectable ports open to the outside, and they mostly enforce this with NAT. Going to look into Greg's suggestion. -- _____________________________________ ---This space for rent--- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

I use LogMeIn Hamachi. Works fine on oS 12.1 through 13.1. Only thing is I couldn't use the latest version (wouldn't work, but I don't remember what the exact error message was); ended up digging up version 2.0.1 on the interwebs and it's worked fine :) If you need RPMs, shoot me a direct message and I'll try to get them to you. If you use the free version, you're limited to four incoming connections; if you need more than that, I think it's like $20 a year or something like that. I use it for two things - one is for hosting a Minecraft server for some of my friends and I to use, the other is to be able to access my OwnCloud server when I'm away from home. Chris

...

...

James Knott 12/20/13 6:53 AM >>> John Andersen wrote: College won't allow listening on ports, and they have him behind a NAT.

One thing about NAT. It's not just a matter of opening ports. You have to map that port to the desired computer. Since they're likely using DHCP, the address of that computer could change with time, unless they lock that IP address to a specific MAC address. This is likely more "support" than they're willing to offer. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

John Andersen wrote:

This is why Greg's suggestion seems to hold the most promise.

Its clear that the cloud machine that Greg mentioned is going to need to be reachable, but it appears like neither of the two endpoints of the ssh connection need public ips. This is classic firewall piercing, like Skype has done for years.

In another note, I mentioned OpenVPN. This will also work. It uses UDP, though, IIRC, it can also be used over UDP. With it, he starts it before he leaves and you have a network connection between his computer and your home network. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

...

...

James Knott 12/20/13 3:07 PM >>> John Andersen wrote: This is why Greg's suggestion seems to hold the most promise.

Its clear that the cloud machine that Greg mentioned is going to need to be reachable, but it appears like neither of the two endpoints of the ssh >>connection need public ips. This is classic firewall piercing, like Skype has done for years.

In another note, I mentioned OpenVPN. This will also work. It uses UDP, though, IIRC, it can also be used over UDP. With it, he starts it before he leaves and you have a network connection between his computer and your home network.

In case my reply got missed earlier - My ISP at home is a small-town one and only hands out NATed IP addresses, so I'm in basically the same situation. I use LogMeIn Hamachi, and it works fine for this. For openSuSE, I've used it on oS 12.1 through 13.1. Only thing is I couldn't use the latest version of the Linux client (wouldn't work, but I don't remember what the exact error message was); ended up digging up version 2.0.1 on the interwebs and it's worked fine :) If you need RPMs, shoot me a direct message and I'll try to get them to you. They also have Mac and Windows clients. If you use the free version, you're limited to four incoming connections; if you need more than that, I think it's like $20 a year or something like that. I use it for two things - one is for hosting a Minecraft server for some of my friends and I to use, the other is to be able to access my OwnCloud server when I'm away from home. Chris -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org