Remote desktop connection to Raspberry Pi without specifying a port

Question

I have a Raspberry Pi running Raspbian Wheezy connected in "Site A", where the network is managed by a third party company and where all ports are closed the the Internet (for security reasons). So, there is no way for me to do any port forwarding to VNC, nor SSH or anything else. That means I just can't access it in any way other than locally, on-site.

However, I need to connect to that device on the X Desktop session (graphical interface) to do some maintenance, and I am located in let's say "Site B", which is nearly 300 miles away from site A.

I know you can do such tasks on Windows or x86 Linux computers with TeamViewer (we use it for our other hardware in the same location and it works like a charm), but since the Raspberry Pi is based on an ARM architecture, it isn't supported by TeamViewer yet.

If anyone has ever achieved this, I would be glad to hear how to do it!

Answer 1

What you would need to do is create a reverse SSH tunnel. You would have to configure the Pi to do this before you place it at the remote locations.

What happens is the Pi creates a connection from inside the network. With normal NAT that is considered safe and the connection is established and any data that comes back is routed to the correct IP.

Some professional firewalls might stop such actions on certain ports. You can overcome that by connecting out using port 80. Even more expensive firewalls inspect the packets to make sure they are not forged - In those cases there is not much you can do without figuring out a weak point.

• So you would need a Linux box somewhere on the internet,
  • or your home/office with dyndns or static IP that will accept SSH connections
• lets call the outside server linuxbox.dyndns.ip
• Then on your Pi you will connect to your linuxbox and create a tunnel back to the Pi over SHH on port 222.
• Any more Pi's will need to create tunnels using different ports, like 223, 224, etc.

Issue this command on the remote Pi

ssh -N -R 2222:localhost:22 [email protected]

So the Pi connected to your linuxbox and created a tunnel within that connection back to the Pi :) On the linux box you will connect to the Pi using.

sh -l piUser -p 2222 localhost

Here is an interesting and slightly twisted article on how to do it step by step.

Answer 2

I'm not (previously) familiar with TeamViewer but I can give you a clue about this: it's not using "no port".¹ It's using a port, and this is connected outward to the TeamViewer external servers.

When you make an attempt to connect from outside, you make a request via the TeamViewer servers, and since they are already connected to the other system, they don't have to worry about any firewall.

Firewalls generally work by placing a lot of restrictions on incoming new connections. I'm guessing you can surf the web from the computers at site A;² this is because they are allowed to establish outgoing connections, and once a connection is established, replies from outside associated with that connection are allowed to pass through. If you are running TeamViewer on a computer in site A, it has an established connection to the TeamViewer servers, and hence, the TeamViewer servers can then arrange a connection to a third party at site B when asked.

So, you could do the same thing but it would require:

• A external server that is running 24/7, or at least whenever site A computers need to be accessible.

• Some software which works like TeamViewer, namely, by connecting to the external server from site A, then, on outside request to the to the external server, uses this connection to create connections from wherever. This is not as big a task as it may sound if you are doing it to suit your specific situation, but it will require a programmer with networking experience.

¹ There is no such thing as a "portless" TCP or UDP connection; ports are integral to the protocol. In the TeamViewer FAQ, it refers to 80, 443, and 5938.

² If not, this implies the firewall is explicitly configured to allow for TeamViewer.

Answer 3

Another tool you could use, especially if you have no permanently running external server is TOR. You can create a TOR hidden service for your ssh port. The TOR client on the Raspberry Pi will then connect to TOR server which will manage the endpoint. You can connect to the hidden service URL (something.onion) from another device and it will route the connection to the Raspberry. You will need to configure TOR so it can make outgoing connections on the Raspberry if there are restrictions/the need for a proxy in the network where the Pi is, but TOR is very good at this and even used to bypass the Chinese firewall.

Using this method, you need no permanently running server (because you use a TOR server as meeting point). Downside is, the connection is over six TOR nodes and encrypted multiple times, which makes is slower. SSH is usually fine to use, and if you need more bandwidth/less latency you can just connect using SSH over TOR and then start a outgoing connection from the Raspberry Pi to your current IP. (like in the other answer, but because you only start the connection on demand you don't need to have the server running all the time or with a static IP/hostname)

(if the link to create the hidden service is down, use https://tor.stackexchange.com/a/2169/7922 )

Answer 4

A TeamViewer-like service called Weaved now provides this functionality for devices like the Raspberry Pi. It is also documented in the official Pi's documentation.

Basically steps:

• sign up for a Weaved account
• install and configure the ~250KB Weaved service on your Raspbian
• access the configured service e.g. SSH via a link provided by Weaved's online portal

Answer 5

As of 2016, you can also use the Cayenne myDevices for remote access. I have used it successfully. It's slow but usable. Check it out here: myDevices

You can also setup events, triggers. They also have an Iphone app. Best of all, it's free :)