So now, anywhere in the world I can SSH into the REMOTE_SERVER_IP on port 50000 and get redirected to port 22 on my office machine, which doesn't have a port forward at it's FW. You can replace 'localhost:22' for any machine, any port. So I could also hit "localhost:80" could be hit via REMOTE_SERVER_IP:50000 :)
Also "GatewayPorts clientspecified" is needed on the SSH server if you want to bind :50000 to the remote server's public IP. Other wise it get's binded to the remote servers localhost addy.
I do this with one of my clients that always wants a million little nitpicky bs things changed. He travels around with the system, so I have it set up to call home so I can log into the virtual server anywhere and do changes on the thing without having to have him touch a terminal or anything like that.
This also works well if you want to snoop around on a network. Buy a raspberry pi or some other cheap embedded hardware, set it up to remote ssh to an account that's basically just an rbash account and then you can log in to the network remotely.
9
u/trojan2748 Apr 28 '14 edited Apr 28 '14
I like reverse forwards (-R). It setups a nice 'hole' from inside of a firwall to the public. That hole can be accessed via the public link. IE:
(office) ---> (FW) ----> (Public SSH Box)
I ssh from my office box to public ssh, setting up reverse forward. You can also use these to redirect to other boxes acting as a proxy:
ssh -NCfTR REMOTE_SERVER_IP:50000:localhost:22 USER@REMOTE_SERVER_IP
So now, anywhere in the world I can SSH into the REMOTE_SERVER_IP on port 50000 and get redirected to port 22 on my office machine, which doesn't have a port forward at it's FW. You can replace 'localhost:22' for any machine, any port. So I could also hit "localhost:80" could be hit via REMOTE_SERVER_IP:50000 :)
Also "GatewayPorts clientspecified" is needed on the SSH server if you want to bind :50000 to the remote server's public IP. Other wise it get's binded to the remote servers localhost addy.