1

I have a Raspberry Pi Zero W (PiZeroW-1, Raspbian Buster)on a local network behind a 4G router with CGNat. To be able to communicate with it from elsewhere I have setup a reverse ssh tunnel that is launched automatically after booting by systemd, by means of a ssh server on a second raspberry pi (PiZero2-1, Raspbian Bullseye) that can be accessed externally through port 22 forwarded to port 2222 on the second router:

/etc/systemd/system/ssh_reverse_tunnel.service:

[Unit]
Description=reverse ssh tunnel service
After=multi-user.target
Requires=network.target
StartLimitIntervalSec=0
[Service]
Type=simple
Restart=on-failure
RestartSec=1
User=pi
ExecStart=/usr/bin/ssh -tt -R 19999:localhost:22 [email protected] -p 2222
StartLimitIntervalSec=0
[Install]
WantedBy=multi-user.target

After booting I can access from the second Raspi the one behind the 4G router without any issue by means of:

pi@PiZero2-1:~ $ ssh localhost -p 19999

After a few hours (sometimes a few days), the tunnel stops working from the second Raspi side:

pi@PiZero2-1:~ $ ssh localhost -p 19999
ssh: connect to host localhost port 19999: Connection refused

When this happens, the tunnel is still working from the first Raspi side:

pi@PiZeroW-1:~ $ systemctl status ssh_reverse_tunnel

● ssh_reverse_tunnel.service - reverse ssh tunnel service
   Loaded: loaded (/etc/systemd/system/ssh_reverse_tunnel.service; enabled; vendor preset: enabled)
   Active: active (running) since Mon 2021-12-20 18:01:41 CET; 1min 8s ago
 Main PID: 597 (ssh)
    Tasks: 1 (limit: 725)
   CGroup: /system.slice/ssh_reverse_tunnel.service
           └─597 /usr/bin/ssh -tt -R 19999:localhost:22 [email protected] -p 2222

dic 20 18:01:41 PiZeroW-1 systemd[1]: Started reverse ssh tunnel service.
dic 20 18:02:04 PiZeroW-1 ssh[597]: Linux PiZero2-1 5.10.63+ #1488 Thu Nov 18 16:14:04 GMT 2021 armv6l
dic 20 18:02:04 PiZeroW-1 ssh[597]: [1B blob data]
dic 20 18:02:04 PiZeroW-1 ssh[597]: The programs included with the Debian GNU/Linux system are free software;
dic 20 18:02:04 PiZeroW-1 ssh[597]: the exact distribution terms for each program are described in the
dic 20 18:02:04 PiZeroW-1 ssh[597]: individual files in /usr/share/doc/*/copyright.
dic 20 18:02:04 PiZeroW-1 ssh[597]: [1B blob data]
dic 20 18:02:04 PiZeroW-1 ssh[597]: Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
dic 20 18:02:04 PiZeroW-1 ssh[597]: permitted by applicable law.
dic 20 18:02:04 PiZeroW-1 ssh[597]: Last login: Mon Dec 20 17:54:58 2021 from 95.127.169.53

pi@PiZeroW-1:~ $ ps -ax | grep ssh

  426 ?        Ss     0:00 /usr/sbin/sshd -D
  619 ?        Ss     0:01 /usr/bin/ssh -tt -R 19999:localhost:22 [email protected] -p 2222
  639 ?        Ss     0:00 sshd: pi [priv]
  669 ?        S      0:01 sshd: pi@pts/0
  730 ?        Ss     0:00 /usr/bin/ssh-agent x-session-manager
  801 ?        Ss     0:00 /usr/bin/ssh-agent -s
 1029 ?        Ss     0:00 sshd: pi [priv]
 1035 ?        S      0:00 sshd: pi@pts/2
22544 pts/0    S+     0:00 grep --color=auto ssh

... but it is not working from the other end.

If I reboot the second Raspberry (PiZero2-1), the problem persists. If I reboot the first Raspberry (PiZeroW-1), the problems disappears (till a few hours or a few days later).

Anybody has some idea about the possible origin of the tunnel stalling ? I have been stuck here for several days and right now the only solution I can realize to guarantee to keep the communication open is to program to reboot the first Raspi from time to time...

BTW: the 4G router and its corresponding local network is to be located in my second home, 600 kms away from where I normally live. I must guarantee that once started the communication will not stop.

1 Answer 1

1

I came across a pretty similar issue. To fix it, I use autossh for the client set to send a packet every 15 seconds. I suppose you could edit sshd_config to automatically send packets but I tried this first.

My ExecStart line looks like this:

ExecStart=/usr/bin/autossh -M 0 -N -o "ServerAliveInterval 15" -R 22222:localhost:22 username@serverip

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.