ssh tunnel - remote access through nat

martinko gamato at
Tue Oct 10 14:58:50 PDT 2006

Nikos Vassiliadis wrote:
> On Tuesday 25 July 2006 20:03, Drew wrote:
>> Hi,
>> I've got a box that's nat'd out to the internet. It is occassionally
>> neccessary for me to access this box remotely. The obvious answer is:
>> ssh -R 7777:localhost:22 cat
>> run from the nat'd box where remote box is a place I pretty much always
>> have access too from anywhere, anytime. The problem is that the connection
>> between these two boxes is famously unreliable - so I need to ensure that
>> this connection stays available. Unfortunately, the procedure for this is
>> not obvious to me. I've thought about a cron job, as the connection would
>> simply fail if it couldn't bind to 7777 on the remote box to listen. But
>> I'm thinking there has to be something that makes more sense. Suggestions?
>> Feedback? Thanks in advance for any pointers.
> you can do something like this in bourne-like shells:
> while true; do
> 	ssh -N ...
> 	sleep 1
> done
> and something like this in csh:
> while ( 1 )
> 	...
> end
> from ssh manual:
>      -N      Do not execute a remote command.  This is useful for just for-
>              warding ports (protocol version 2 only).
> The sleep command is used to add a little delay in case there is some-
> thing really wrong and ssh returns immediately, resulting in looping
> very fast.
> Then you just have to ensure that ssh will be aware of a dropped
> connection (by the means of keep-alives) and exit. You can do this
> with ssh, but you have configure keep-alives on both machines,
> client and server.
> An alternative method would be ipfw keep-alives for dynamic rules
> and you have to configure it only on the box you're ssh'ing from. It
> works very nice.
> In both cases you have to use public key authentication in order to
> log on automatically after a network failure. I guess it's already
> set up.
> A few pointers, read ssh, sshd, ssh-keygen and ipfw manuals
> HTH, Nikos


I was just thinking along these lines this evening -- putting ssh in
loop so that the tunnel is recreated whenever connection drops.
However, I'd like to automate it somehow so that the machine creating
tunnel can be restarted and it tries to open up tunnel when it boots up.
The thing is that if I just simply create an rc script to achieve this,
the script is run under root and ssh cannot make use of public key
authentication which is set up now for a user running it manually.
Or is there a way to change identity somehow or to run an rc script
under different user account ??



More information about the freebsd-questions mailing list