mirror of
https://github.com/openoms/bitcoin-tutorials.git
synced 2025-12-19 12:54:19 +01:00
140 lines
4.8 KiB
Markdown
140 lines
4.8 KiB
Markdown
# Forward ports with a reverse SSH tunnel
|
|
|
|
## Advantages:
|
|
* no port forwarding needed on the LAN of the host
|
|
* encrypted connection
|
|
* hides the IP of the host from the public
|
|
|
|
## Requirements:
|
|
* a Virtual Private Server (VPS) - eg. a minimal package on Lunanode for ~3.5$/month
|
|
* root access on the VPS - only root can forward ports under no. 1000
|
|
* ssh access to the host computer (where the ports will be forwarded from)
|
|
|
|
## On the host computer
|
|
* login as root or run:
|
|
`$ sudo su -`
|
|
|
|
* Check for an ssh public key:
|
|
`# cat ./.ssh/*.pub`
|
|
|
|
* if there is none generate one (keep pressing ENTER):
|
|
`# ssh-keygen -t rsa -b 4096`
|
|
* keep pressing [ENTER] to use the default values:
|
|
```
|
|
Generating public/private rsa key pair.
|
|
Enter file in which to save the key (/root/.ssh/id_rsa):
|
|
Enter passphrase (empty for no passphrase):
|
|
Enter same passphrase again:
|
|
Your identification has been saved in /root/.ssh/id_rsa.
|
|
Your public key has been saved in /root/.ssh/id_rsa.pub.
|
|
The key fingerprint is:
|
|
SHA256:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx root@hostname
|
|
The key's randomart image is:
|
|
+---[RSA 4096]----+
|
|
| xxxx |
|
|
| xxxxx |
|
|
| xxxxx |
|
|
| xxxxxx |
|
|
| xxxxxxxxx |
|
|
| xxxxxxxx |
|
|
| xxxxxxxxxx |
|
|
| xxxxxxxxxxx |
|
|
| xxxxxxxxxx |
|
|
+----[SHA256]-----+
|
|
```
|
|
|
|
* copy the ssh public key over to the VPS (fill in the VPS_IP_ADDRESS).
|
|
Will be prompted for the root password of the VPS.
|
|
`# ssh-copy-id root@VPS_IP_ADDRESS`
|
|
|
|
## Working on the VPS
|
|
|
|
* login as root or run:
|
|
`$ sudo su -`
|
|
|
|
* edit the sshd config:
|
|
`# nano /etc/ssh/sshd_config`
|
|
|
|
* make sure these entries are active (uncommented, meaning there is no `#` at the beggining of the line).
|
|
Can just paste these on the end of the file:
|
|
```
|
|
RSAAuthentication yes
|
|
PubkeyAuthentication yes
|
|
GatewayPorts yes
|
|
AllowTcpForwarding yes
|
|
ClientAliveInterval 60
|
|
```
|
|
CTRL+O, ENTER to save, CTRL+X to exit.
|
|
|
|
* restart the sshd service (WARNING: you can lose access at this point if the config is wrong):
|
|
`# systemctl restart sshd`
|
|
|
|
## Back to the host computer
|
|
|
|
### Set up a systemd service
|
|
|
|
* create the service file:
|
|
`# nano /etc/systemd/system/autossh-tunnel.service`
|
|
|
|
* Paste the following and fill in the VPS_IP_ADDRESS.
|
|
Add or remove ports as required.
|
|
|
|
```
|
|
[Unit]
|
|
Description=AutoSSH tunnel service
|
|
After=network.target
|
|
|
|
[Service]
|
|
User=root
|
|
Group=root
|
|
Environment="AUTOSSH_GATETIME=0"
|
|
ExecStart=/usr/bin/autossh -C -M 0 -v -N -o "ServerAliveInterval=60" -R 9735:localhost:9735 -R 443:localhost:443 -R 80:localhost:80 root@VPS_IP_ADDRESS
|
|
StandardOutput=journal
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
```
|
|
* Enable and start the service:
|
|
`# systemctl enable autossh-tunnel`
|
|
`# systemctl start autossh-tunnel`
|
|
|
|
* The port forwarding with a reverse ssh-tunnel is now complete.
|
|
You should be able access the ports/services of the host computer through the IP of the VPS.
|
|
|
|
## Monitoring
|
|
|
|
* Check if there are any errors on the host computer:
|
|
`# sudo journalctl -f -n 20 -u autossh-tunnel`
|
|
* Look for the lines:
|
|
```
|
|
debug1: Authentication succeeded (publickey).
|
|
debug1: Remote connections from LOCALHOST:9735 forwarded to local address localhost:9735
|
|
debug1: Remote connections from LOCALHOST:443 forwarded to local address localhost:443
|
|
debug1: Remote connections from LOCALHOST:80 forwarded to local address localhost:80
|
|
debug1: remote forward success for: listen 9735, connect localhost:9735
|
|
debug1: remote forward success for: listen 443, connect localhost:443
|
|
debug1: remote forward success for: listen 80, connect localhost:80
|
|
debug1: All remote forwarding requests processed
|
|
```
|
|
|
|
* To check if tunnel is active on the VPS:
|
|
`# netstat -tulpn`
|
|
|
|
* Look for the lines:
|
|
```
|
|
Active Internet connections (only servers)
|
|
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
|
|
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 7694/sshd: root
|
|
tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN 7694/sshd: root
|
|
tcp 0 0 0.0.0.0:9735 0.0.0.0:* LISTEN 7694/sshd: root
|
|
tcp6 0 0 :::80 :::* LISTEN 7694/sshd: root
|
|
tcp6 0 0 :::443 :::* LISTEN 7694/sshd: root
|
|
tcp6 0 0 :::9735 :::* LISTEN 7694/sshd: root
|
|
```
|
|
|
|
## Resources
|
|
|
|
https://github.com/rootzoll/raspiblitz/blob/master/FAQ.md#how-to-setup-port-forwarding-with-a-ssh-tunnel
|
|
|
|
https://stadicus.github.io/RaspiBolt/raspibolt_21_security.html#login-with-ssh-keys
|