Csdrhrt

what I'm trying to do is to enable a Raspberry, physically placed in a client's site, that has internet access via Dynamic IP, to receive SSH commands from the wild without having to manipulate the client's router and firewall. No Inbound connections allowed on that network, plus, the internet address of the Client's site is dynamic.

Edit: to know the solution for this problem, refer to the replies of Kevin_Kinsey and Florin Godard, or scroll to the end of my question to know how I was able to get it working on non-standard SSH port 22.

I've already tried to study and understand what's proposed on ssh to private-ip on Unix Stack Exchange, but I'm really not getting the point.

I do want to connect from my, say, laptop, to the Client's VPS server, and make the VPS server connect to the Raspberry SSH. So:

           ( firewall access allow in+out )

      | =>           VPS Server                  ( firewall access allow out only )

      |                                      | =>    Raspberry

MY PC /

Here is it a case scenario with given IP adresses, ports and names configurations:

MY PC 

    name: mypc@local.lan



Client VPS Server

    name: remote.null.tld

    IP Address: 98.76.54.32

    SSH Port: 9876



Raspberry

    model: Zero W

    name: raspi1@clientlocal.lan

    IP Address: dynamic IP ( based on Internet Provider )

    SSH Port: 6789

    Raspberry's iptables: empty

    Router's Firewall Restrictions: allow only out

    Internet stability: very low

The Raspberry's external IP is the one assigned from the Internet Provider, and may vary depending on router restarts. Cannot determine it absolutely.

Internet Access on the client's network is really unstable. Radio link or something like that. Anyway, internet connection suffers of very dancing bandwidth.

Plus, the Client's router cannot be manipulated not because of laziness but because of restrictions imposed by the Client's IT dep.

I do have SSH access to the Client's VPS and I'm able to install whatever software on it.

Edit: solution to the problem

On my configuration, ports were non-standard. So, the solution was this one:

On the Raspberry:

# login to username@remote.null.tld is done via private/public key with no passwords

ssh -p 9876 -f -N -T -R 55555:localhost:6789 username@remote.null.tld

On the Raspberry's crontab:

# A re-connect is performed at every 10th minute of every hour to prevent accidental tunnel breakdowns.

10 * * * * ps -ef | grep 'ssh -p 9876 -f -N -T -R' | grep -v grep | awk '{print $2}' | xargs -r kill -9 && sleep 30s && ssh -p 9876 -f -N -T -R 55555:localhost:6789 username@remote.null.tld >/dev/null 2>&1

On the bridge VPS remote.null.tld

ssh -p 55555 raspberry_username@localhost

Or, a more elegant solution via modifying the VPS's ssh config:

Host tunnelToRemoteRaspberry

    Hostname localhost

    User raspberry_username

    Port 55555

This is possible. Use "reverse port forwarding". You'll probably need a cronjob set up to check if it's connected. If not, run something like this:

ssh -f -N -T -R 2210:localhost:22 me@example.com

"Example.com" is some server outside the FW that you do have access to. You're forwarding port 22 on the RPi to port 2210 on example.com. You can then SSH into example.com and do:

ssh RaspberryUser@localhost -p 2210

And you'll be connected to the RPi box.

I am assuming the user names remote on the VPS and pi on the raspberry.

1. You choose a free port on the VPS. A random five-digit value below 65000 should work.


2. 
   

   On the Raspberry, you run

   
   
   

   ssh -R PORT:localhost:22 remote@vps
   
   

   
   


3. 
   

   On the VPS, you connect to the Raspberry with

   
   
   

   ssh -p PORT pi@localhost
   
   

   
   

Replace the PORT with the port you have chosen in the first step.

In step 2, you create a reverse tunnel from the PORT on the VPS to port 22 on the Raspberry, which is where the Raspberry's SSH server listens. In step 3, you connect to the PORT on the VPS and get transferred to the port 22 on the Raspberry.

You can then configure a connection inside the VPS' ~/.ssh/config such as:

Host raspberryTunnel

  Hostname localhost

  User pi

  Port PORT

If that works reliably, you can replace the single SSH connection on the Raspberry with autossh, which will automatically recreate the connection when it goes down.

autossh -R PORT:localhost:22 remote@vps

What you're trying to do exactly as you ask is impossible:

No Inbound connections allowed on that network

However, you can easily:

• have the Pi make an outbound connection to your laptop using reverse SSH that you schedule
  


• 
  ssh from your laptop to the VPS server and from the VPS server ssh again to the Pi