title: How to bypass firewall and NAT with reverse SSH Tunnel
body: <p>I'm trying to generate an SSH server in a machine behind a router.</p>
  
  <p>First I tried to bind the SSH to my public IP address:</p>
  
  <pre><code>ssh -R 10002:localhost:22 &lt;ip_address&gt;
  </code></pre>
  
  <p>Then I'm prompted with a password request, however my username password doesn't seem to work.</p>
  
  <p>Obviously I know my username password, so it seems to me that it's trying to authenticate in  another computer under the same network.</p>
  
  <p>Any suggestions how to fix this?</p>
  
  <p>It would also help me any alternative on how to create an SSH server behind a Router when you don't have access to the Router.</p>
  
  <p>The ports in iptables are all open.</p>
  
  <p><strong>UPDATE</strong></p>
  
  <p>As suggested by <a href="https://stackoverflow.com/users/2858218/thomas-oster">Thomas Oster</a> answer I've tried the following.</p>
  
  <p>In the machine behind the router I've executed the following command:</p>
  
  <p><code>$ ssh -R10002:localhost:22 &lt;remote_public_ip_address&gt; -l &lt;my_remote_server_username&gt;</code></p>
  
  <p><code>&lt;remote_ip_address&gt;</code> being the remote_ip_address of a server with public IP and SSH server on which I have full control.</p>
  
  <p><code>&lt;my_remote_server_username&gt;</code> being the remote server username.</p>
  
  <p>After that, I've tried to connect from the remote server to the server behind the router like this:</p>
  
  <p><code>$ ssh -p 10002 &lt;remote_public_ip_address&gt;</code></p>
  
  <p>However this command displays the following output:</p>
  
  <pre><code>ssh: connect to host &lt;remote_public_ip_address&gt; port 10002: Connection refused
  </code></pre>
  
  <p>So I opened the 10002 port in the iptables firewall using the following command:</p>
  
  <pre><code>sudo iptables -A INPUT -p tcp --dport 10002 -j ACCEPT
  </code></pre>
  
  <p>After that I've executed again the command but it displays the same error message.</p>
  
  <p>In my machine behind the router I have all ports open in iptables.</p>
  
  <p><strong>UPDATE 2</strong></p>
  
  <blockquote>
    <p>You have to allow port-forwarding in the /etc/ssh/sshd_config of the
    remove_public_ip_address server</p>
  </blockquote>
  
  <p>I've tried to allow portforwarding in the sshd_config file adding this command:</p>
  
  <pre><code>LocalForward 10002 &lt;my_remote_public_server_ip&gt;:22
  </code></pre>
  
  <p>But it gave me this error message:</p>
  
  <pre><code>Bad configuration option: LocalForward
  </code></pre>
  
  <blockquote>
    <p>After "ssh -R...." did you leave the window open?</p>
  </blockquote>
  
  <p>After executing that command, it connects to the remote public machine, and yes, I left the window open.</p>
  
  <blockquote>
    <p>Can you use ssh -p 10002 localhost on the public server after the
    tunnel is created?</p>
  </blockquote>
  
  <p>Yes, if I execute that command in the public server, it connects after asking me for credentials.</p>
  
  <blockquote>
    <p>Please try "ssh localhost" on the machine behind the router to check if sshd is running and working.</p>
  </blockquote>
  
  <p>This also works.</p>
  
  <p><strong>UPDATE 3</strong></p>
  
  <p>I've been finally able to make it work (thanks again to <a href="https://stackoverflow.com/users/2858218/thomas-oster">Thomas Oster</a>)</p>
  
  <p>We are going to work with three machines:</p>
  
  <p>Destination Machine: That we want to connect to.</p>
  
  <p>Middle Machine: A server acting as an intermediary for the connection (a Linode in my case)</p>
  
  <p>Home Computer: Where we will access to the destination machine.</p>
  
  <p>These are the steps I followed</p>
  
  <p><strong>Step 1:</strong></p>
  
  <pre><code>[destination computer]$ vi /etc/ssh/sshd_config
  </code></pre>
  
  <p>Add the GatewayPorts option:</p>
  
  <p>GatewayPorts   yes</p>
  
  <p>Restart ssh.</p>
  
  <p><strong>Step 2:</strong></p>
  
  <pre><code>[destination computer]$ ssh -R 4040:localhost:22 middle-machine-user@middle-machine-public-ip
  </code></pre>
  
  <p>This will link your public machine with your destination computer via port 4040</p>
  
  <p>It will connect to the middle machine and prompt the terminal, you must leave this tab open.</p>
  
  <p><strong>Step 3:</strong></p>
  
  <p>Connect from home:</p>
  
  <pre><code>ssh destination-user@destination-ip -p4040
  </code></pre>
  
  <p>Or connect from the middle machine:</p>
  
  <pre><code>[home computer]$ ssh middle-machine-user@middle-machine-ip
  
  [middle computer]$ ssh destination-user@localhost -p4040
  </code></pre>
  
  <p><a href="http://linuxers.org/article/reverse-ssh-tunneling-bypassing-firewalls-and-nat" rel="nofollow noreferrer">Source</a></p>