The ferry is also running on its own naval route ( connection) between two ports. It has a source port and a destination one. It’s allowing the road to pass over an obstacle. Let’s try to broaden that concept and say that a ferry transporting cars across some body of water is in a sense also acting as a tunnel. It’s something you dig out to allow the road to continue through an obstacle. Let’s zoom out for a second and ask what a tunnel is in a general sense. What’s an SSH tunnel and how does it differ from a connection? By this act you form an SSH connection between the two. In the most basic form, you use the SSH client on your workstation to connect to the SSH server on the remote side. If you’re reading this you’ve probably heard of SSH, the cryptographic network protocol usually running on port 22 which allows you access to the shell of a remote machine. This part we already covered: ssh -R 12345:localhost:22 -p 6789.Want an easy way to SSH to a device behind a firewall but don’t want to set up a VPN? Welcome to the pragmatic person’s approach - Reverse SSH tunneling. Since port 6789 of routerA is forwarding to port 22 of A, we get our connection. This was done with ssh But now, A is behind routerA and port 6789 of routerA is forwarding to port 22 of A, so we have to specify that port in the original SSH connection: ssh -p 6789. Host B must create a SSH connection to host A.This is not really that much more complex, but we have to “divide and conquer” the problem, or layer it: The goal is still the same: have host A access the firewalled host B. Let’s say we have a routerA that forwards port 6789 to port 22 (SSH’s default port) of host A. You can use this knowledge to have communication rolling even when you have to deal with pesky firewalls and inaccessible routers.Ī convoluted, but common setup, is having a router sitting between A and the internet (check the diagram below). We’ve now covered the typical ways both normal and reverse tunnels are used. With this inceptionesque scenario, we have a SSH connection (blue arrow, initiated by A) inside another SSH connection (big pink arrow, initiated by B). This will initiate a SSH connection in port 12345 of localhost, which is forwarded, by the reverse tunnel, to port 22 of host B, creating the desired connection. Then you can just type ssh -p 12345 to have an interactive SSH session in a terminal in host A.

B actually executes ssh -R 12345:():22 Now A can access port 22 of localhost of host B if it makes connections on port 12345 on localhost of A (the diagram below clarafies this). We then add the reverse tunnel on top of that, to forward connection on port X of A (let’s give it a number, say 12345) to port 22 of B. B initiates a SSH connection to A: ssh This is the base command.The more common case is just making a SSH connection into a firewalled host. Let’s forget about Jupyter Notebooks for now. SSH into a firewalled host with a reverse tunnel You can, once again, access the Jupyter Notebook in port 8888 of localhost in host A and it will be served pages from host B (port 8888). Notice how the purple arrow (initial SSH connection) is now going leftwards, but the blue arrow (the forwarding tunnel) is still going towards the right. Note that the SSH connection is initiated from B to A, but the forwarded connections inside the tunnel are from A to B. It works exactly as -L, but in a different direction. We need to reverse this, by using -R option instead. If we used -L again, we'd be forwarding connections on port 8888 of B to port 8888 of A, exactly the opposite of what we want. We still want to do that, but now the SSH connection will start from host B. We still have the same scenario, that is, we want A to be able to access, locally, the Jupyter Notebook running in host B (this could be any service, really).īefore, we used the -L option, which forwarded local connection on port 8888 of A to port 8888 of B. manually), then you can still make the connection work by using a reverse tunnel. But, if you have direct access to it, if you can directly configure it (e.g. You can’t access host B with a SSH connection, because B is fenced. That’s where reverse tunnels enter the picture. But what if you can’t configure the router or firewall? The reverse tunnel If B sits behind a router, you just need to make sure there is a port forwarding rule from port 22 of routerB to port 22 of B.

Reverse ssh shell tunnels