Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.networking > #1425 > unrolled thread

SSH connection through a router applying NAT

Back to article view | Back to comp.os.linux.networking

Contents

  SSH connection through a router applying NAT Marco <netuse@lavabit.com> - 2012-05-30 22:12 +0200
    Re: SSH connection through a router applying NAT Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2012-05-30 22:57 +0200
      Re: SSH connection through a router applying NAT Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2012-05-30 22:58 +0200
        Re: SSH connection through a router applying NAT Marco <netuse@lavabit.com> - 2012-05-30 23:12 +0200
          Re: SSH connection through a router applying NAT Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2012-05-31 00:10 +0200
            Re: SSH connection through a router applying NAT Marco <netuse@lavabit.com> - 2012-06-01 00:00 +0200
              Re: SSH connection through a router applying NAT Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2012-06-09 13:04 +0200
    Re: SSH connection through a router applying NAT Rick Jones <rick.jones2@hp.com> - 2012-05-30 22:45 +0000
      Re: SSH connection through a router applying NAT Marco <netuse@lavabit.com> - 2012-05-31 12:44 +0200
        Re: SSH connection through a router applying NAT David Brown <david@westcontrol.removethisbit.com> - 2012-05-31 12:58 +0200
          Re: SSH connection through a router applying NAT Marco <netuse@lavabit.com> - 2012-05-31 13:31 +0200
            Re: SSH connection through a router applying NAT J G Miller <miller@yoyo.ORG> - 2012-05-31 12:55 +0000
            Re: SSH connection through a router applying NAT David Brown <david.brown@removethis.hesbynett.no> - 2012-05-31 15:01 +0200
              Re: SSH connection through a router applying NAT Richard Kettlewell <rjk@greenend.org.uk> - 2012-05-31 14:36 +0100
          Re: SSH connection through a router applying NAT Whiskers <catwheezel@operamail.com> - 2012-05-31 13:45 +0000
            Re: SSH connection through a router applying NAT Marco <netuse@lavabit.com> - 2012-05-31 17:38 +0200
              Re: SSH connection through a router applying NAT Whiskers <catwheezel@operamail.com> - 2012-05-31 18:30 +0000
                Re: SSH connection through a router applying NAT J G Miller <miller@yoyo.ORG> - 2012-05-31 20:07 +0000
        Re: SSH connection through a router applying NAT J G Miller <miller@yoyo.ORG> - 2012-05-31 12:53 +0000
    Re: SSH connection through a router applying NAT Ralph Spitzner <rasp@spitzner.org> - 2012-05-31 09:56 +0200
      Re: SSH connection through a router applying NAT Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2012-06-09 13:06 +0200
    Re: SSH connection through a router applying NAT Chris Davies <chris-usenet@roaima.co.uk> - 2012-05-31 09:04 +0100
    Re: SSH connection through a router applying NAT ein <ein@no.spam> - 2012-06-02 11:40 +0200
    Re: SSH connection through a router applying NAT "Ralph" <ralphzodapn@ymeal.com> - 2012-06-05 11:30 +0000

Page 1 of 2  [1] 2  Next page →

#1425 — SSH connection through a router applying NAT

Hi,

I want to be able to connect to my home computer via SSH from
the outside.

The problem is that I am behind a NAT. Everybody in this building
has the same IP to the outside world. Communication within the
network works. I can ping and connect to other computers. However,
from the outside I am unable to reach my computer or even ping my
external IP address.

I have no access to the router which would enable me to redirect
incoming requests to a particular port to my computer.

Is there a possibility to set up access to my computer? If yes, how?
All instructions I have found suggest reconfiguring the router,
which is not possible in my case.

I am willing to provide additional information, just let me know
what.


Regards

Marco

[toc] | [next] | [standalone]

#1426

Hello,

Marco a écrit :
> 
> I want to be able to connect to my home computer via SSH from
> the outside.
> 
> The problem is that I am behind a NAT. Everybody in this building
> has the same IP to the outside world. Communication within the
> network works. I can ping and connect to other computers. However,
> from the outside I am unable to reach my computer or even ping my
> external IP address.
> 
> I have no access to the router which would enable me to redirect
> incoming requests to a particular port to my computer.
> 
> Is there a possibility to set up access to my computer?

Short answer : not easily, if possible.

> If yes, how?

STUN, hole punching...

[toc] | [prev] | [next] | [standalone]

#1427

Pascal Hambourg a écrit :
> Hello,
> 
> Marco a écrit :
>> I want to be able to connect to my home computer via SSH from
>> the outside.
>>
>> The problem is that I am behind a NAT. Everybody in this building
>> has the same IP to the outside world. Communication within the
>> network works. I can ping and connect to other computers. However,
>> from the outside I am unable to reach my computer or even ping my
>> external IP address.
>>
>> I have no access to the router which would enable me to redirect
>> incoming requests to a particular port to my computer.
>>
>> Is there a possibility to set up access to my computer?
> 
> Short answer : not easily, if possible.
> 
>> If yes, how?
> 
> STUN, hole punching...

Also : tunnelling, VPN, IPv6...

[toc] | [prev] | [next] | [standalone]

#1428

On 2012-05-30 Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> wrote:

Thanks for your quick response.

> > STUN,

I never heard of stun. Now I read the wikipedia article but
honestly, I still don't have an idea how this works. I'v found a
Debian package ”stun”. If you have experience with that, can you
shortly describe how it works? Where do I have to set this up?

> hole punching...

This seems to involve a public third party server, which I don't
have.

> Also : tunnelling, VPN,

How can a VPN help? I cannot establish a VPN from my computer since
I am not at home and have no remote access (which is the whole point
of doing this). And I cannot reach my computer from the outside. If
I could do VPN, then I could simply SSH into my machine, right?
Maybe I misunderstand you.

> IPv6...

I never worked with IPv6. “ip addr” lists an IPv6 address for my
interface. Can you elaborate how this solves my problem? Thanks

Regards

Marco

[toc] | [prev] | [next] | [standalone]

#1429

Marco a écrit :
> 
>>> STUN,
> 
> I never heard of stun. Now I read the wikipedia article but
> honestly, I still don't have an idea how this works. I'v found a
> Debian package "stun". If you have experience with that, can you
> shortly describe how it works? Where do I have to set this up?

Sorry I have no experience with STUN.

>> hole punching...
> 
> This seems to involve a public third party server, which I don't
> have.

Not necessarily. It could be your client host if it has a known public
address or host name.

>> Also : tunnelling, VPN,
> 
> How can a VPN help? I cannot establish a VPN from my computer since
> I am not at home and have no remote access (which is the whole point
> of doing this). And I cannot reach my computer from the outside. If
> I could do VPN, then I could simply SSH into my machine, right?
> Maybe I misunderstand you.

You can establish a tunnel or VPN from your server to an outside public
endpoint (either a VPN provider or your outside host). Then you can
communicate with your server from the outside through this endpoint.

>> IPv6...
> 
> I never worked with IPv6. "ip addr" lists an IPv6 address for my
> interface.

Is it the (useless) link local address or a global address ?

> Can you elaborate how this solves my problem? Thanks

An IPv6 tunnel broker could provide a global IPv6 connectivity to your
server (and client, if required). It is another form of tunnelling.

[toc] | [prev] | [next] | [standalone]

#1450

On 2012-05-31 Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> wrote:

> > I never worked with IPv6. "ip addr" lists an IPv6 address for my
> > interface.
> 
> Is it the (useless) link local address or a global address ?

Since you phrase the question like this, I blindly assume it is the
“useless” link local address. ip addr outputs:

inet6 fe80::21b:77ff:fe14:b9a6/64 scope link valid_lft forever preferred_lft forever

I can not ping this address from outside, which renders it useless,
I guess.


Marco

[toc] | [prev] | [next] | [standalone]

#1472

Marco a écrit :
> 
> Since you phrase the question like this, I blindly assume it is the
> "useless" link local address. ip addr outputs:
> 
> inet6 fe80::21b:77ff:fe14:b9a6/64 scope link valid_lft forever preferred_lft forever
> 
> I can not ping this address from outside, which renders it useless,
> I guess.

Indeed.

[toc] | [prev] | [next] | [standalone]

#1430

Marco <netuse@lavabit.com> wrote:
> I want to be able to connect to my home computer via SSH from
> the outside.

> The problem is that I am behind a NAT. Everybody in this building
> has the same IP to the outside world. Communication within the
> network works. I can ping and connect to other computers. However,
> from the outside I am unable to reach my computer or even ping my
> external IP address.

> I have no access to the router which would enable me to redirect
> incoming requests to a particular port to my computer.

> Is there a possibility to set up access to my computer? If yes, how?
> All instructions I have found suggest reconfiguring the router,
> which is not possible in my case.

> I am willing to provide additional information, just let me know
> what.

Not that I seek to pour cold water on your plans, but when you say
"Everybody in this building" do you mean a business?  If so, you might
want to make sure you aren't about to violate a company policy or
three...

rick jones
-- 
Wisdom Teeth are impacted, people are affected by the effects of events.
these opinions are mine, all mine; HP might not want them anyway... :)
feel free to post, OR email to rick.jones2 in hp.com but NOT BOTH...

[toc] | [prev] | [next] | [standalone]

#1436

On 2012-05-30 Rick Jones <rick.jones2@hp.com> wrote:

> Not that I seek to pour cold water on your plans, but when you say
> "Everybody in this building" do you mean a business?  If so, you might
> want to make sure you aren't about to violate a company policy or
> three...

No, it's a private flat. In my former flat I connected via the
telephone line. Here the telephone lines are dead, but Ethernet
sockets are provided. I guess all the cables gather in the basement
in a switch (since I see dozens of other computers and my
neighbours' communication with wireshark) and then go through a NAT
router to the ISP.

I don't think I violate any policy when I just try to SSH to my
computer.

Marco

[toc] | [prev] | [next] | [standalone]

#1437

On 31/05/2012 12:44, Marco wrote:
> On 2012-05-30 Rick Jones<rick.jones2@hp.com>  wrote:
>
>> Not that I seek to pour cold water on your plans, but when you say
>> "Everybody in this building" do you mean a business?  If so, you might
>> want to make sure you aren't about to violate a company policy or
>> three...
>
> No, it's a private flat. In my former flat I connected via the
> telephone line. Here the telephone lines are dead, but Ethernet
> sockets are provided. I guess all the cables gather in the basement
> in a switch (since I see dozens of other computers and my
> neighbours' communication with wireshark) and then go through a NAT
> router to the ISP.
>

Viewing your neighbours' communications with wireshark is likely to be 
violating the building's policy, if they have written a decent one.  It 
is also possibly a criminal offence in some countries.

Of course, the people responsible for the network in the building have 
done a poor job if you can view other people's traffic like this.  It's 
the sort of incompetent networking administration that gives us the 
botnets we know and love.

> I don't think I violate any policy when I just try to SSH to my
> computer.
>

Trying to figure a way to punch holes in the router and firewall is 
almost certainly against policy, and quite possibly illegal (despite the 
incompetence of the network administrators).  It is also hard and 
unreliable.

Far and away the easiest, safest, and most legal way is to have a 
third-party machine outside the network, which is accessible from 
anywhere.  Your home machine connects to it, your outside client 
connects to it, and the third-party machine connects the two in some way 
(vpn, tunnel, ssh proxy, etc.).

I believe there are some websites designed for this sort of thing, 
though I haven't tried them.  There certainly are for remote desktop 
viewing (mostly targeting windows systems).  Remote hosting or cloud 
servers would work fine, if you can find something cheap enough for your 
budget - it would take absolutely minimal resources.  Or perhaps you 
have friends or relatives with an ADSL line or other always-on, global 
IP network connection, and can leave a little connector box there?  The 
connector box can be as small as a simple wireless router box 
re-programmed with OpenWRT, DD-Wrt, m0n0wall, etc.

[toc] | [prev] | [next] | [standalone]

#1438

On 2012-05-31 David Brown <david@westcontrol.removethisbit.com> wrote:

> Viewing your neighbours' communications with wireshark is likely to be 
> violating the building's policy, if they have written a decent one.

There is no written policy. I pay and receive ”internet access”,
that's all there is.

> It is also possibly a criminal offence in some countries.

I'm not at all interested in what my neighbours are doing. I have my
own router and network for my computers. While developing I use
wireshark and I just happen to see my neighbours communication
(which I filter out anyway). I don't know the laws of the country I
live in, but my personal sense of right tells me that I am allowed
to start wireshark in my own network for developing purposes. And
that's all I do. Honestly, I don't think anyone cares.

> Of course, the people responsible for the network in the building have 
> done a poor job if you can view other people's traffic like this.

I totally agree.

> > I don't think I violate any policy when I just try to SSH to my
> > computer.
> >
> 
> Trying to figure a way to punch holes in the router and firewall is 
> almost certainly against policy, and quite possibly illegal (despite the 
> incompetence of the network administrators).

As I said, there's no written policy. 

> It is also hard and unreliable.

That information is more important than the legal side.

> Far and away the easiest, safest, and most legal way is to have a 
> third-party machine outside the network, which is accessible from 
> anywhere.  Your home machine connects to it, your outside client 
> connects to it, and the third-party machine connects the two in some way 
> (vpn, tunnel, ssh proxy, etc.).
>
> […]
>
> I believe there are some websites designed for this sort of thing, 
> though I haven't tried them.  There certainly are for remote desktop 
> viewing (mostly targeting windows systems).  Remote hosting or cloud 
> servers would work fine, if you can find something cheap enough for your 
> budget - it would take absolutely minimal resources.

I will check if there are suitable services for me. Thanks for the
tip.

> Or perhaps you have friends or relatives with an ADSL line or
> other always-on, global IP network connection, and can leave a
> little connector box there?

Most people here are also behind NAT. I start to develop a strong
dislike against this technology.

Thanks a lot for taking the time to explain the possibilities.


Regards

Marco

[toc] | [prev] | [next] | [standalone]

#1440

On Thursday, May 31st, 2012, at 13:31:30h +0200, Marco declared:

> I don't know the laws of the country I live in

Ignorance of the law has never been a valid legal defense.

[toc] | [prev] | [next] | [standalone]

#1441

On 31/05/12 13:31, Marco wrote:
> On 2012-05-31 David Brown<david@westcontrol.removethisbit.com>  wrote:
>
>> Viewing your neighbours' communications with wireshark is likely to be
>> violating the building's policy, if they have written a decent one.
>
> There is no written policy. I pay and receive ”internet access”,
> that's all there is.
>
>> It is also possibly a criminal offence in some countries.
>
> I'm not at all interested in what my neighbours are doing. I have my
> own router and network for my computers. While developing I use
> wireshark and I just happen to see my neighbours communication
> (which I filter out anyway). I don't know the laws of the country I
> live in, but my personal sense of right tells me that I am allowed
> to start wireshark in my own network for developing purposes. And
> that's all I do. Honestly, I don't think anyone cares.
>

I didn't think for a moment that you were doing anything immoral, or 
even questionable, such as spying on your neighbours.  All I am doing is 
warning you that sometimes these things are illegal.  And you may have 
to be careful - while wireshark is passive, you might also be using 
tools such as nmap, and with such an open network it's easy to 
accidentally "poke" someone else's machine.  All you then need is a 
paranoid user whose software firewall throws up warnings, and who then 
complains of a "hacker" in the building.  Being right, and knowing the 
building network administrators are clueless, is not going to help if 
things get ugly.  Ordinary users don't care, and knowledgeable people 
understand that you are doing no harm - but there is a class in the 
middle of people who know a little and think they know a lot, who can 
cause you trouble.

>> Of course, the people responsible for the network in the building have
>> done a poor job if you can view other people's traffic like this.
>
> I totally agree.
>
>>> I don't think I violate any policy when I just try to SSH to my
>>> computer.
>>>
>>
>> Trying to figure a way to punch holes in the router and firewall is
>> almost certainly against policy, and quite possibly illegal (despite the
>> incompetence of the network administrators).
>
> As I said, there's no written policy.
>
>> It is also hard and unreliable.
>
> That information is more important than the legal side.
>
>> Far and away the easiest, safest, and most legal way is to have a
>> third-party machine outside the network, which is accessible from
>> anywhere.  Your home machine connects to it, your outside client
>> connects to it, and the third-party machine connects the two in some way
>> (vpn, tunnel, ssh proxy, etc.).
>>
>> […]
>>
>> I believe there are some websites designed for this sort of thing,
>> though I haven't tried them.  There certainly are for remote desktop
>> viewing (mostly targeting windows systems).  Remote hosting or cloud
>> servers would work fine, if you can find something cheap enough for your
>> budget - it would take absolutely minimal resources.
>
> I will check if there are suitable services for me. Thanks for the
> tip.
>
>> Or perhaps you have friends or relatives with an ADSL line or
>> other always-on, global IP network connection, and can leave a
>> little connector box there?
>
> Most people here are also behind NAT. I start to develop a strong
> dislike against this technology.
>

NAT has its good points and its bad points.  A NAT router won't stop a 
determined attack, and it won't stop attacks that go around it (such as 
trojans), but it provides a fair amount of security and anonymity at 
very little cost.  It also lets networks make much more efficient use of 
limited routing resources and global IP addresses.

But it /is/ a pain when you need access from the outside - such as your 
case here, or when using protocols like bittorrent.

The best combination is to have a NAT router - but for it to be /your/ 
NAT router, so that you can forward ports as and when you like, and to 
have a valid global IP address on the internet side.  Unfortunately, 
that's not an option for you at the moment.  (If you have Windows PC's 
as well, either your own or perhaps visitors, then I strongly recommend 
you get a cheapo NAT router of your own to protect the Windows machines 
from worms and other malware on the PC's in the building.)

> Thanks a lot for taking the time to explain the possibilities.
>
>
> Regards
>
> Marco
>

[toc] | [prev] | [next] | [standalone]

#1443

David Brown <david.brown@removethis.hesbynett.no> writes:
> On 31/05/12 13:31, Marco wrote:

>> Most people here are also behind NAT. I start to develop a strong
>> dislike against this technology.
>
> NAT has its good points and its bad points.  A NAT router won't stop a
> determined attack, and it won't stop attacks that go around it (such
> as trojans), but it provides a fair amount of security and anonymity
> at very little cost.  It also lets networks make much more efficient
> use of limited routing resources and global IP addresses.

The security aspect has very little to do with the address translation.
Any router with filtering capabilities can do the same; conversely a NAT
router with inadequate or misconfigured filtering would not defend
against an externally originated attack.

-- 
http://www.greenend.org.uk/rjk/

[toc] | [prev] | [next] | [standalone]

#1445

On 2012-05-31, David Brown <david@westcontrol.removethisbit.com> wrote:
> On 31/05/2012 12:44, Marco wrote:
>> On 2012-05-30 Rick Jones<rick.jones2@hp.com>  wrote:

[...]

> Far and away the easiest, safest, and most legal way is to have a 
> third-party machine outside the network, which is accessible from 
> anywhere.  Your home machine connects to it, your outside client 
> connects to it, and the third-party machine connects the two in some way 
> (vpn, tunnel, ssh proxy, etc.).

[...]

Sounds like a job for a "shell account".  The precise mechanism would 
have to be researched, of course.

-- 
-- ^^^^^^^^^^
--  Whiskers 
-- ~~~~~~~~~~

[toc] | [prev] | [next] | [standalone]

#1446

On 2012-05-31 Whiskers <catwheezel@operamail.com> wrote:

> > Far and away the easiest, safest, and most legal way is to have a 
> > third-party machine outside the network, which is accessible from 
> > anywhere.  Your home machine connects to it, your outside client 
> > connects to it, and the third-party machine connects the two in some way 
> > (vpn, tunnel, ssh proxy, etc.).
> 
> [...]
> 
> Sounds like a job for a "shell account".

I don't think it's wise to use the university SSH access for that,
since we have a policy which restricts the use to study purposes,
which I cannot guarantee. But I found other shell providers (and
many of them are free).

How does it work? My home computer always maintains a connection to
the shell provider is assume. Then, from a remote computer, I
connect through the shell provider to my home computer. Does the
entire communication go through the shell server or is it only used
to establish a connection to my home computer?

What is the service I need to set up, a VPN or SSH proxy? If it's
not too cumbersome, maybe I will go for this solution.


Marco

[toc] | [prev] | [next] | [standalone]

#1447

On 2012-05-31, Marco <netuse@lavabit.com> wrote:
> On 2012-05-31 Whiskers <catwheezel@operamail.com> wrote:
>
>> > Far and away the easiest, safest, and most legal way is to have a 
>> > third-party machine outside the network, which is accessible from 
>> > anywhere.  Your home machine connects to it, your outside client 
>> > connects to it, and the third-party machine connects the two in some way 
>> > (vpn, tunnel, ssh proxy, etc.).
>> 
>> [...]
>> 
>> Sounds like a job for a "shell account".
>
> I don't think it's wise to use the university SSH access for that,
> since we have a policy which restricts the use to study purposes,
> which I cannot guarantee. But I found other shell providers (and
> many of them are free).
>
> How does it work? My home computer always maintains a connection to
> the shell provider is assume. 

Or you set up a 'call out' at predetermined times.

> Then, from a remote computer, I
> connect through the shell provider to my home computer. 

How you achieve the connection is what I would have to research, but 
I'm sure it must be possible - and not too difficult.  I would imagine 
(say) an SSH server running on your home computer, and a console in the 
shell account from which you could log in to your home computer.

> Does the
> entire communication go through the shell server or is it only used
> to establish a connection to my home computer?

As you still won't be able to get a public IP number for your home 
computer (only for your communal internet connection), I think routing 
would have to involve the shell account for every packet.

> What is the service I need to set up, a VPN or SSH proxy? If it's
> not too cumbersome, maybe I will go for this solution.
>
>
> Marco

More technicalities I'd have to research!

-- 
-- ^^^^^^^^^^
--  Whiskers 
-- ~~~~~~~~~~

[toc] | [prev] | [next] | [standalone]

#1449

On Thursday, May 31st, 2012, at 18:30:41h +0000, Whiskers explained:
 
> Or you set up a 'call out' at predetermined times.

See the current discussion in alt.os.linux on the subject of
"reverse ssh tunnel"

[toc] | [prev] | [next] | [standalone]

#1439

On Thursday, May 31st, 2012, at 12:44:40 +0200, Marco explained:

> I guess all the cables gather in the basement
> in a switch (since I see dozens of other computers and my
> neighbours' communication with wireshark) and then go through a NAT
> router to the ISP.

So anybody can spy on anybody else's traffic?

And the man from state security "sitting" in the basement
can keep an eye and ear on all the messages coming from
and leaving the building?

Is this apartment building part of a federal institution? ;)

[toc] | [prev] | [next] | [standalone]

#1431

Marco wrote:
> Hi,
>
> I want to be able to connect to my home computer via SSH from
> the outside.
>
> The problem is that I am behind a NAT. Everybody in this building
[...]

Since you have no access to the router, the simple answer is
_NO_

Only possible scenario I could think of is that your 'home'
initiates a connection, but where to ?

	-rasp



-- 
See why I hate Windows users?
      All pain, no gain.
	-Howard Chu

[toc] | [prev] | [next] | [standalone]

Page 1 of 2  [1] 2  Next page →

Back to top | Article view | comp.os.linux.networking

csiph-web