3

I have a Raspberry Pi running Raspbian Wheezy connected in "Site A", where the network is managed by a third party company and where all ports are closed the the Internet (for security reasons). So, there is no way for me to do any port forwarding to VNC, nor SSH or anything else. That means I just can't access it in any way other than locally, on-site.

However, I need to connect to that device on the X Desktop session (graphical interface) to do some maintenance, and I am located in let's say "Site B", which is nearly 300 miles away from site A.

I know you can do such tasks on Windows or x86 Linux computers with TeamViewer (we use it for our other hardware in the same location and it works like a charm), but since the Raspberry Pi is based on an ARM architecture, it isn't supported by TeamViewer yet.

If anyone has ever achieved this, I would be glad to hear how to do it!

  • Can the Pi at Site A connect to Site B at all ? – Lawrence Oct 30 '13 at 16:29
  • Considering the fact that Site B (where I am) has a fixed IP address and that we have control over the network (to open ports and such), yes, the Pi in site A would be able to connect to site B, as the connection is outbound not inbound. The thing is we need it the other way around, so site B must be able to connect to the Raspberry Pi in site A, where all ports are closed to the Web. The inbound connections in site A on a specific port are all denied. – Max Methot Oct 30 '13 at 17:01
6

What you would need to do is create a reverse SSH tunnel. You would have to configure the Pi to do this before you place it at the remote locations.

What happens is the Pi creates a connection from inside the network. With normal NAT that is considered safe and the connection is established and any data that comes back is routed to the correct IP.

Some professional firewalls might stop such actions on certain ports. You can overcome that by connecting out using port 80. Even more expensive firewalls inspect the packets to make sure they are not forged - In those cases there is not much you can do without figuring out a weak point.

  • So you would need a Linux box somewhere on the internet,
    • or your home/office with dyndns or static IP that will accept SSH connections
  • lets call the outside server linuxbox.dyndns.ip
  • Then on your Pi you will connect to your linuxbox and create a tunnel back to the Pi over SHH on port 222.
  • Any more Pi's will need to create tunnels using different ports, like 223, 224, etc.

Issue this command on the remote Pi

ssh -N -R 2222:localhost:22 serverUser@linuxbox.dyndns.ip

So the Pi connected to your linuxbox and created a tunnel within that connection back to the Pi :) On the linux box you will connect to the Pi using.

sh -l piUser -p 2222 localhost

Here is an interesting and slightly twisted article on how to do it step by step.

  • 1
    This is what I was going to suggest. As site A can connect to Site B, the Pi at Site A can connect to a server on Site B to establish this tunnel. Make the SSH server at Site B accept connections from other machines on this tunnel, and it will act as the gateway to access the Pi – Lawrence Oct 31 '13 at 1:16
  • Yea I saw your comment asking if the Pi can connect to the remote computer after I answered and thought you might have thought of the same :) – Piotr Kula Oct 31 '13 at 8:45
  • 1
    This seems like a good way to achieve what I want. I'll definitely try it and come back to tell you how it went. Thank you for the quite creative idea! The article explains it pretty good indeed, thanks again! – Max Methot Oct 31 '13 at 11:50
  • 1
    If you can't leave your outside computer online constantly to maintain the tunnel, you could run a script on the pi at specific intervals (e.g. on the hour) when it will check for an existing connection, and if not, try to establish one. Then when you need to connect, you just make sure your site B computer is online and accessible at whatever o'clock. – goldilocks Oct 31 '13 at 11:55
2

I'm not (previously) familiar with TeamViewer but I can give you a clue about this: it's not using "no port".1 It's using a port, and this is connected outward to the TeamViewer external servers.

When you make an attempt to connect from outside, you make a request via the TeamViewer servers, and since they are already connected to the other system, they don't have to worry about any firewall.

Firewalls generally work by placing a lot of restrictions on incoming new connections. I'm guessing you can surf the web from the computers at site A;2 this is because they are allowed to establish outgoing connections, and once a connection is established, replies from outside associated with that connection are allowed to pass through. If you are running TeamViewer on a computer in site A, it has an established connection to the TeamViewer servers, and hence, the TeamViewer servers can then arrange a connection to a third party at site B when asked.

So, you could do the same thing but it would require:

  • A external server that is running 24/7, or at least whenever site A computers need to be accessible.

  • Some software which works like TeamViewer, namely, by connecting to the external server from site A, then, on outside request to the to the external server, uses this connection to create connections from wherever. This is not as big a task as it may sound if you are doing it to suit your specific situation, but it will require a programmer with networking experience.

1 There is no such thing as a "portless" TCP or UDP connection; ports are integral to the protocol. In the TeamViewer FAQ, it refers to 80, 443, and 5938.

2 If not, this implies the firewall is explicitly configured to allow for TeamViewer.

  • Thank you goldilocks, I really wondered how TeamViewer managed to work in such a secured environment and your explanation helped me better understand it. – Max Methot Oct 31 '13 at 11:45
  • ppumkin's suggestion is a good one as it bypasses the need for the external server if you can establish a connection from A to B and leave it up (i.e., leave the site B boxes online). – goldilocks Oct 31 '13 at 11:53
2

Another tool you could use, especially if you have no permanently running external server is TOR. You can create a TOR hidden service for your ssh port. The TOR client on the Raspberry Pi will then connect to TOR server which will manage the endpoint. You can connect to the hidden service URL (something.onion) from another device and it will route the connection to the Raspberry. You will need to configure TOR so it can make outgoing connections on the Raspberry if there are restrictions/the need for a proxy in the network where the Pi is, but TOR is very good at this and even used to bypass the Chinese firewall.

Using this method, you need no permanently running server (because you use a TOR server as meeting point). Downside is, the connection is over six TOR nodes and encrypted multiple times, which makes is slower. SSH is usually fine to use, and if you need more bandwidth/less latency you can just connect using SSH over TOR and then start a outgoing connection from the Raspberry Pi to your current IP. (like in the other answer, but because you only start the connection on demand you don't need to have the server running all the time or with a static IP/hostname)

(if the link to create the hidden service is down, use https://tor.stackexchange.com/a/2169/7922 )

0

A TeamViewer-like service called Weaved now provides this functionality for devices like the Raspberry Pi. It is also documented in the official Pi's documentation.

Basically steps:

  • sign up for a Weaved account
  • install and configure the ~250KB Weaved service on your Raspbian
  • access the configured service e.g. SSH via a link provided by Weaved's online portal
  • This does seem to be targeted at Windows IoT on the Remote (Site A) Rpi - but the Op points out that they are using Raspian Wheezy (or that they were when they asked the question!) – SlySven Jan 16 '16 at 12:40
  • @SlySven: There is a client for various architectures, including Raspbian (Wheezy and Jessie). Refer to weaved.com/installing-weaved-raspberry-pi-raspbian-os – Islay Jan 17 '16 at 21:41
0

As of 2016, you can also use the Cayenne myDevices for remote access. I have used it successfully. It's slow but usable. Check it out here: myDevices

You can also setup events, triggers. They also have an Iphone app. Best of all, it's free :)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.