Connect to a device's SSH on a network that has no inbound traffic enabled and no static IP address

Question

what I'm trying to do is to enable a Raspberry, physically placed in a client's site, that has internet access via Dynamic IP, to receive SSH commands from the wild without having to manipulate the client's router and firewall. No Inbound connections allowed on that network, plus, the internet address of the Client's site is dynamic.

Edit: to know the solution for this problem, refer to the replies of Kevin_Kinsey and Florin Godard, or scroll to the end of my question to know how I was able to get it working on non-standard SSH port 22.

I've already tried to study and understand what's proposed on ssh to private-ip on Unix Stack Exchange, but I'm really not getting the point.

I do want to connect from my, say, laptop, to the Client's VPS server, and make the VPS server connect to the Raspberry SSH. So:

           ( firewall access allow in+out )
      | =>           VPS Server              \    ( firewall access allow out only )
      |                                      | =>    Raspberry
MY PC /

Here is it a case scenario with given IP adresses, ports and names configurations:

MY PC 
    name: mypc@local.lan

Client VPS Server
    name: remote.null.tld
    IP Address: 98.76.54.32
    SSH Port: 9876

Raspberry
    model: Zero W
    name: raspi1@clientlocal.lan
    IP Address: dynamic IP ( based on Internet Provider )
    SSH Port: 6789
    Raspberry's iptables: empty
    Router's Firewall Restrictions: allow only out
    Internet stability: very low

The Raspberry's external IP is the one assigned from the Internet Provider, and may vary depending on router restarts. Cannot determine it absolutely.

Internet Access on the client's network is really unstable. Radio link or something like that. Anyway, internet connection suffers of very dancing bandwidth.

Plus, the Client's router cannot be manipulated not because of laziness but because of restrictions imposed by the Client's IT dep.

I do have SSH access to the Client's VPS and I'm able to install whatever software on it.

Edit: solution to the problem

On my configuration, ports were non-standard. So, the solution was this one:

On the Raspberry:

# login to username@remote.null.tld is done via private/public key with no passwords
ssh -p 9876 -f -N -T -R 55555:localhost:6789 username@remote.null.tld

On the Raspberry's crontab:

# A re-connect is performed at every 10th minute of every hour to prevent accidental tunnel breakdowns.
10 * * * * ps -ef | grep 'ssh -p 9876 -f -N -T -R' | grep -v grep | awk '{print $2}' | xargs -r kill -9 && sleep 30s && ssh -p 9876 -f -N -T -R 55555:localhost:6789 username@remote.null.tld >/dev/null 2>&1

On the bridge VPS remote.null.tld

ssh -p 55555 raspberry_username@localhost

Or, a more elegant solution via modifying the VPS's ssh config:

Host tunnelToRemoteRaspberry
    Hostname localhost
    User raspberry_username
    Port 55555

Answer 1

I am assuming the user names remote on the VPS and pi on the raspberry.

1. You choose a free port on the VPS. A random five-digit value below 65000 should work.

2. On the Raspberry, you run

   ssh -R PORT:localhost:22 remote@vps
   

3. On the VPS, you connect to the Raspberry with

   ssh -p PORT pi@localhost
   

Replace the PORT with the port you have chosen in the first step.

In step 2, you create a reverse tunnel from the PORT on the VPS to port 22 on the Raspberry, which is where the Raspberry's SSH server listens. In step 3, you connect to the PORT on the VPS and get transferred to the port 22 on the Raspberry.

You can then configure a connection inside the VPS' ~/.ssh/config such as:

Host raspberryTunnel
  Hostname localhost
  User pi
  Port PORT

If that works reliably, you can replace the single SSH connection on the Raspberry with autossh, which will automatically recreate the connection when it goes down.

autossh -R PORT:localhost:22 remote@vps

Answer 2

This is possible. Use "reverse port forwarding". You'll probably need a cronjob set up to check if it's connected. If not, run something like this:

ssh -f -N -T -R 2210:localhost:22 me@example.com

"Example.com" is some server outside the FW that you do have access to. You're forwarding port 22 on the RPi to port 2210 on example.com. You can then SSH into example.com and do:

ssh RaspberryUser@localhost -p 2210

And you'll be connected to the RPi box.

Answer 3

What you're trying to do exactly as you ask is impossible:

No Inbound connections allowed on that network

However, you can easily:

• have the Pi make an outbound connection to your laptop using reverse SSH that you schedule
• ssh from your laptop to the VPS server and from the VPS server ssh again to the Pi

Answer 4

Essentially, you can reach your goal only with maintenance connections from the device to a server you maintain.

What exactly these connections consist of can be different:

• connect, fetch tasks to execute and proceed with them.
• connect to a VPN and be part of that, allowing to be connected to
• connect via SSH and establish a tunnel connection

Usable protocols

• VPN (uses several ports)
• SSH
• HTTPS
• even UUCP, although a little bit outdated

Depending on what the customer allows inside their network, you can even implement several of these methods to then choose from.

Each method has its pros and cons.

• SSH:

  • +: only one port needed
  • -: maybe not every network allows outbound SSH connections

• VPN:

  • +: easiest integration into server's network
  • -: several ports needed
  • -: maybe not every network allows outbound SSH connections

• HTTPS:

  • +: probably supported
  • -: no real command line, only "work packages" are sendable
  • -: big effort needed to set up

• UUCP:

  • +: allows batches to be sent
  • -: outdated protocol

Answer 5

If Pi firewall doesn't allow incoming connections then there is no way to establish connection. Your only way is to punch a hole through a firewall by using established connections.

Answer 6

I'd check out ZeroTier: it lets you set up a virtual network with the rules you want, e.g., that any node can directly connect to any other node. They handle all kinds of connectivity issues under the hood, including relaying traffic through their servers if needed.