Connecting to a service on a host behind NAT from another host behind NAT over the Internet
Assume you have a host (hosta) that is running a TCP service (e.g. a VNC server on port 5901). You want to access to this service from another host (hostb) running a VNC client. Both hosts are connected to Internet, but there are some restrictions:
1. hosta can be reached from the Internet using any of its TCP ports
VNC client on hostb connects to hosta:5091 directly.
2. hosta can be reached from the Internet only through SSH
From hostb:
ssh -L 5901:localhost:5901 usera@hosta
VNC client on hostb connects to localhost:5901
3. hosta cannot be reached from the Internet (e.g. it is behind CGN / CGNAT). However, hostb can be reached from the Internet
From hosta:
ssh -R 5901:localhost:5901 userb@hostb
VNC client on hostb connects to localhost:5901
4. hosta and hostb cannot be reached from the Internet. They are behind CGN / CGNAT; they can only create outbound connections
We can use another host (hostc) which can be reached from the Internet using ssh.
From hosta:
ssh -R 5555:localhost:5901 userc@hostc
From hostb:
ssh -L 5901:localhost:5555 userc@hostc
VNC client on hostb connects to localhost:5901
I have a case like the 4th scenario above, but I do not wish to use a third host (hostc), mainly because of performance and cost reasons.
What are my alternative (cheaper [=free] and better performance) options?
Note 1: I have tested and determined that although TCP hole punching does not work in my case, UDP hole punching does work. However, I need a tool that will establish connection oriented (similar to TCP) session over UDP that will utilize UDP hole punching.
Note 2: Failing to use any of "UDP hole punching" programs available on the Internet, I decided to write my own. I am still improving it, but, as it is, it works fairly well. You can find it here.
networking ssh internet port forwarding
asked Jan 6 at 12:43
FedonKadifeliFedonKadifeli
114
add a comment |
Assume you have a host (hosta) that is running a TCP service (e.g. a VNC server on port 5901). You want to access to this service from another host (hostb) running a VNC client. Both hosts are connected to Internet, but there are some restrictions:
1. hosta can be reached from the Internet using any of its TCP ports
VNC client on hostb connects to hosta:5091 directly.
2. hosta can be reached from the Internet only through SSH
From hostb:
ssh -L 5901:localhost:5901 usera@hosta
VNC client on hostb connects to localhost:5901
3. hosta cannot be reached from the Internet (e.g. it is behind CGN / CGNAT). However, hostb can be reached from the Internet
From hosta:
ssh -R 5901:localhost:5901 userb@hostb
VNC client on hostb connects to localhost:5901
4. hosta and hostb cannot be reached from the Internet. They are behind CGN / CGNAT; they can only create outbound connections
We can use another host (hostc) which can be reached from the Internet using ssh.
From hosta:
ssh -R 5555:localhost:5901 userc@hostc
From hostb:
ssh -L 5901:localhost:5555 userc@hostc
VNC client on hostb connects to localhost:5901
I have a case like the 4th scenario above, but I do not wish to use a third host (hostc), mainly because of performance and cost reasons.
What are my alternative (cheaper [=free] and better performance) options?
Note 1: I have tested and determined that although TCP hole punching does not work in my case, UDP hole punching does work. However, I need a tool that will establish connection oriented (similar to TCP) session over UDP that will utilize UDP hole punching.
Note 2: Failing to use any of "UDP hole punching" programs available on the Internet, I decided to write my own. I am still improving it, but, as it is, it works fairly well. You can find it here.
networking ssh internet port forwarding
asked Jan 6 at 12:43
FedonKadifeliFedonKadifeli
114
1
Not sure that you'd be able to get away from using a commonly accessible (third) machine, in your fourth use case. Alternatives to SSH would include virtual private LANs (e.g., Hamachi) or VPNs, both of which (in your case) would still require a third party.
– joat
Jan 6 at 14:08
You haven't much alternatives here: either one of NATs should be configured for port forwarding or external host should be used.
– montonero
Jan 16 at 11:32
@montonero yup. but at times, that isn't the case. EG - brother and sister go to 2 different universities, and both are behind NAT and have no ability to change configuration at either end.
– ivanivan
Feb 3 at 15:58
@ivanivan in this case some intermediate host should be involved. to make a connection you'll need to have an open port at some point.
– montonero
Feb 4 at 7:18
add a comment |
Assume you have a host (hosta) that is running a TCP service (e.g. a VNC server on port 5901). You want to access to this service from another host (hostb) running a VNC client. Both hosts are connected to Internet, but there are some restrictions:
1. hosta can be reached from the Internet using any of its TCP ports
VNC client on hostb connects to hosta:5091 directly.
2. hosta can be reached from the Internet only through SSH
From hostb:
ssh -L 5901:localhost:5901 usera@hosta
VNC client on hostb connects to localhost:5901
3. hosta cannot be reached from the Internet (e.g. it is behind CGN / CGNAT). However, hostb can be reached from the Internet
From hosta:
ssh -R 5901:localhost:5901 userb@hostb
VNC client on hostb connects to localhost:5901
4. hosta and hostb cannot be reached from the Internet. They are behind CGN / CGNAT; they can only create outbound connections
We can use another host (hostc) which can be reached from the Internet using ssh.
From hosta:
ssh -R 5555:localhost:5901 userc@hostc
From hostb:
ssh -L 5901:localhost:5555 userc@hostc
VNC client on hostb connects to localhost:5901
I have a case like the 4th scenario above, but I do not wish to use a third host (hostc), mainly because of performance and cost reasons.
What are my alternative (cheaper [=free] and better performance) options?
Note 1: I have tested and determined that although TCP hole punching does not work in my case, UDP hole punching does work. However, I need a tool that will establish connection oriented (similar to TCP) session over UDP that will utilize UDP hole punching.
Note 2: Failing to use any of "UDP hole punching" programs available on the Internet, I decided to write my own. I am still improving it, but, as it is, it works fairly well. You can find it here.
networking ssh internet port forwarding
asked Jan 6 at 12:43
FedonKadifeliFedonKadifeli
114
Assume you have a host (hosta) that is running a TCP service (e.g. a VNC server on port 5901). You want to access to this service from another host (hostb) running a VNC client. Both hosts are connected to Internet, but there are some restrictions:
1. hosta can be reached from the Internet using any of its TCP ports
VNC client on hostb connects to hosta:5091 directly.
2. hosta can be reached from the Internet only through SSH
From hostb:
ssh -L 5901:localhost:5901 usera@hosta
VNC client on hostb connects to localhost:5901
3. hosta cannot be reached from the Internet (e.g. it is behind CGN / CGNAT). However, hostb can be reached from the Internet
From hosta:
ssh -R 5901:localhost:5901 userb@hostb
VNC client on hostb connects to localhost:5901
4. hosta and hostb cannot be reached from the Internet. They are behind CGN / CGNAT; they can only create outbound connections
We can use another host (hostc) which can be reached from the Internet using ssh.
From hosta:
ssh -R 5555:localhost:5901 userc@hostc
From hostb:
ssh -L 5901:localhost:5555 userc@hostc
VNC client on hostb connects to localhost:5901
I have a case like the 4th scenario above, but I do not wish to use a third host (hostc), mainly because of performance and cost reasons.
What are my alternative (cheaper [=free] and better performance) options?
Note 1: I have tested and determined that although TCP hole punching does not work in my case, UDP hole punching does work. However, I need a tool that will establish connection oriented (similar to TCP) session over UDP that will utilize UDP hole punching.
Note 2: Failing to use any of "UDP hole punching" programs available on the Internet, I decided to write my own. I am still improving it, but, as it is, it works fairly well. You can find it here.
networking ssh internet port forwarding
networking ssh internet port forwarding
asked Jan 6 at 12:43
FedonKadifeliFedonKadifeli
114
asked Jan 6 at 12:43
FedonKadifeliFedonKadifeli
114
edited Feb 3 at 15:49
FedonKadifeli
asked Jan 6 at 12:43
FedonKadifeliFedonKadifeli
114
asked Jan 6 at 12:43
FedonKadifeliFedonKadifeli
114
asked Jan 6 at 12:43
FedonKadifeliFedonKadifeli
114
114
1
Not sure that you'd be able to get away from using a commonly accessible (third) machine, in your fourth use case. Alternatives to SSH would include virtual private LANs (e.g., Hamachi) or VPNs, both of which (in your case) would still require a third party.
– joat
Jan 6 at 14:08
You haven't much alternatives here: either one of NATs should be configured for port forwarding or external host should be used.
– montonero
Jan 16 at 11:32
@montonero yup. but at times, that isn't the case. EG - brother and sister go to 2 different universities, and both are behind NAT and have no ability to change configuration at either end.
– ivanivan
Feb 3 at 15:58
@ivanivan in this case some intermediate host should be involved. to make a connection you'll need to have an open port at some point.
– montonero
Feb 4 at 7:18
add a comment |
1
Not sure that you'd be able to get away from using a commonly accessible (third) machine, in your fourth use case. Alternatives to SSH would include virtual private LANs (e.g., Hamachi) or VPNs, both of which (in your case) would still require a third party.
– joat
Jan 6 at 14:08
You haven't much alternatives here: either one of NATs should be configured for port forwarding or external host should be used.
– montonero
Jan 16 at 11:32
@montonero yup. but at times, that isn't the case. EG - brother and sister go to 2 different universities, and both are behind NAT and have no ability to change configuration at either end.
– ivanivan
Feb 3 at 15:58
@ivanivan in this case some intermediate host should be involved. to make a connection you'll need to have an open port at some point.
– montonero
Feb 4 at 7:18
1
1
Not sure that you'd be able to get away from using a commonly accessible (third) machine, in your fourth use case. Alternatives to SSH would include virtual private LANs (e.g., Hamachi) or VPNs, both of which (in your case) would still require a third party.
– joat
Jan 6 at 14:08
Not sure that you'd be able to get away from using a commonly accessible (third) machine, in your fourth use case. Alternatives to SSH would include virtual private LANs (e.g., Hamachi) or VPNs, both of which (in your case) would still require a third party.
– joat
Jan 6 at 14:08
You haven't much alternatives here: either one of NATs should be configured for port forwarding or external host should be used.
– montonero
Jan 16 at 11:32
You haven't much alternatives here: either one of NATs should be configured for port forwarding or external host should be used.
– montonero
Jan 16 at 11:32
@montonero yup. but at times, that isn't the case. EG - brother and sister go to 2 different universities, and both are behind NAT and have no ability to change configuration at either end.
– ivanivan
Feb 3 at 15:58
@montonero yup. but at times, that isn't the case. EG - brother and sister go to 2 different universities, and both are behind NAT and have no ability to change configuration at either end.
– ivanivan
Feb 3 at 15:58
@ivanivan in this case some intermediate host should be involved. to make a connection you'll need to have an open port at some point.
– montonero
Feb 4 at 7:18
@ivanivan in this case some intermediate host should be involved. to make a connection you'll need to have an open port at some point.
– montonero
Feb 4 at 7:18
add a comment |
0
active
oldest
votes
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "3"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1391146%2fconnecting-to-a-service-on-a-host-behind-nat-from-another-host-behind-nat-over-t%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
Thanks for contributing an answer to Super User!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1391146%2fconnecting-to-a-service-on-a-host-behind-nat-from-another-host-behind-nat-over-t%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
1
Not sure that you'd be able to get away from using a commonly accessible (third) machine, in your fourth use case. Alternatives to SSH would include virtual private LANs (e.g., Hamachi) or VPNs, both of which (in your case) would still require a third party.
– joat
Jan 6 at 14:08
You haven't much alternatives here: either one of NATs should be configured for port forwarding or external host should be used.
– montonero
Jan 16 at 11:32
@montonero yup. but at times, that isn't the case. EG - brother and sister go to 2 different universities, and both are behind NAT and have no ability to change configuration at either end.
– ivanivan
Feb 3 at 15:58
@ivanivan in this case some intermediate host should be involved. to make a connection you'll need to have an open port at some point.
– montonero
Feb 4 at 7:18