2

i have at my school a raspberry pi 3 and i want to tunnel it directly over my windows pc at home. At my school i can't get a port forwarding and the raspi haven't a public IPv4.

Now the Question: Is it possible to make a Reverse SSH Tunnel only with my pc at home (with port-forwarding)?

My Idea: Run FreeSSHd on my Win-HomePC (with forwarded Ports), connect from my raspi at school to my HomePC via ssh (e.g. ssh 79.43.X.X) and connect via PuTTY back.

Is this possible? And how I need to configure the raspi, freesshd and putty?

2 Answers 2

5

Disclaimer: I have no experience with any ssh software under windows.

Important preamble:

You really should check back with your school's IT department, whether they like your idea. If you just do it right away, and they find out, you are in serious trouble.

I know, school networks are oftentimes very amateurly monitored, so your chances may be quite good. And I know, a properly secured tunnel is nothing to be afraid from.

But one should always adhere to company/network policies. And if there's no policy explicitly forbidding something, you might want to think about what you are expected to do on this network. In schools, you are usually expected to browse the web or send emails. If you do anything beyond this, you might want to contact the IT department.

If you got your OK, proceed:

Step 1:

For this to work, you need to configure public key authentication on your FreeSSHd server. I'm sorry, I can't help you with that. And you need to create you public/private keys on your Pi. Depending, whether you want root or your current user to be the one to establish the connection, issue

ssh-keygen or sudo ssh-keygen (when asked for a password, just hit enter)

This will create a *.pub-file in either /root/.ssh/ or in your ~/.ssh/. Copy this file to your home machine. Now you need to google the FreeSSHd specifics. You may have something like an authorized_keys file. Copy the contents of the *.pub into this file.

Now, you should be able to ssh home from your Pi, without typing in a password.

Step 2:

On the Pi, you can open a reverse ssh tunnel with a command like this:

ssh -f -N -R 14000:localhost:22 [email protected]

22 is the local port (where sshd on the Pi is listening). 14000 is the remote port number you chose (also see below). You can configure this line to be automatically executed on startup (make sure, network is available, before this command is issured - or you could just do some sleep). Also, it's worth noting, that autossh may be a good substitute for ssh in this case (see here).

Step 3:

Back home on your machine, you connect to localhost, with the port you previously provided:

ssh -p 14000 piuser@localhost

As I said, I only have Linux experience. If FreeSSHd works as I am used to, you should just be able to open a similar connection with PuTTY (target is localhost/127.0.0.1, port is 14000).


Other idea:

An other method I really like is to host your own hidden service on your Pi. This way, you have your own TOR-address and a firewall/NAT becomes kind of transparent. Therefore you need no reverse ssh tunnel, as you can connect directly (via TOR). I use this for a RasPi server, which is out in the field, otherwise inaccessible behind a UMTS-Stick.

However, I do not recommend to host a hidden service in school. You could have a chat with your IT guys about this, but don't expect them to be happy. I added this, as it can be a valuable trick in some circumstances, and it's good to have heard about it. But I have to reiterate: Don't try this at school.

2
  • 1
    +1 for advising OP to check with the school's administration first Commented Mar 7, 2018 at 23:06
  • Yep ... very sensible advice ...
    – sijones
    Commented Apr 20, 2020 at 7:11
0

I do something similar from home to work. I use Linux at home and ssh port forward to a Pi which then redirects through the ssh tunnel to the Win10 box (10.0.0.104). Port 3389 is remote desktop. Your home windows machine might not have remote desktop available if it the home edition.

Ssh does encryption and compression and rdesktop does too, so I have turned off rdesktop's encryption and compression and limited the transmitted colorspace to save bandwidth.

My script is:

#!/bin/bash -x

ssh -N -p 22 [email protected] -L 5555:10.0.0.104:3389 &
SSH_PID=$!

sleep 5

rdesktop -a 16 -f  -z  -u "<USER NAME" -E 127.0.0.1:5555

kill -9 $SSH_PID

You can check with your schools IT guy since a firewall rule can be set to limit an ssh connection to a single IP address (your home). That would lower the exposure of the school to ssh attacks. In fact, the Pi must have a firewall that drops all ssh connections except the connection from your home IP address. That is, Pi machine should have an "NSA quality" iptables or nft firewall anyway.

Once this is working mount your music on the schools Pi as an SMB remote file system and export to wifi via a kodi server for playing on your cell phone.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.