5

I am trying to setup a remote connection (from anywhere in the world not just locally) to my Raspberry Pi 3. I want to do so without port forwarding, and without third party service (such as Weaved, or Digitalocean). Only using open-source software. I am even willing to pay for a dedicated domain and server if the solution requires it.

To describe what I have, take a look at attached image - my network configuration. I have a RPi3 at home with a static IP address. It is connected to a router (wlan0). And I want to connect to the RPi3 from "My laptop" - via SSH.

My network setup Possible solutions that I read on different forums: There is a possibility to establish a reverse ssh connection to my laptop. The problem is that my Home router's firewall won't any incoming connection go through - I don't want to open ports such as 3389.

My questions are:

  1. If I establish this reverse tunnel, is it possible for my laptop to connect to the RPi3 at any moment I want? Or do I need to implement it on the RPi3 as scheduled service and then I'd be able to connect only every hour or so?
  2. How can I implement this, theoretically.
Improve this question
1
  • you can use real-time messaging (like WebSockets or MQTT broker or PubNub etc.) to tell your raspberry pi to start the tunnel when want to connect and the stop it when it is not in use to close the surface of attack and improve security (this approach we used while developing tunnelin.com service).
    – simon
    Aug 3, 2020 at 13:29

4 Answers 4

Reset to default
4

First of all:

You MUST have an open port to connect to something. Anything else is like talking to someone's locked front-door instead of that person.

Reverse tunnelling:

This means that the Pi3 connects to something. Then orders that something to return traffic through that same connection.

This way you can talk to your Pi3 through that tunnel. Which in reality is a forwarded open port. Except for two things.

  1. The exposed socket is located at another external IP than your home.
  2. Traffic in the tunnel goes over shh, which should be encrypted. That means your ISP can't see what the packages contain.

Laptop vs 3rd party:

If your laptop has: 1. The same IP all the time (or a very fast ddns). 2. An ssh-socket exposed to the web.

Then you won't need a third party. The Pi3 can ssh (connect) to you, and then you use that connection to connect to what ever you want at home. If you don't have both those points sorted. You'll need a third party.

The third party:

Has to be somewhere that both your laptop and your Pi3 can connect to at any time. It has to be something that accepts ssh connections, and that can forward traffic both to, and from both the Pi and Laptop back through those connections.

Security:

If that third party has shitty security, you're better off forwarding an external port at home, to port 22 on the Pi3.

And securing the Pi3. Like allowing ONLY pubkey authentication, No external root logins. NO password logins. And setting options to ignore traffic (for an hour or two) from any IP with more than 5 or 6 failed login-attempts in 15 minutes (just an example).

Tunnel Persistence:

For the Pi3 to stay accessible, if you go with reverse-tunnelling, you can use something like autossh combined with cron-jobs. Perfect to keep the tunnel(s) up when possible. Even after reboots, the Pi3 will connect to it's target.

Improve this answer
6
  • Clearly represented. Another issue is that a reverse tunnel pokes a hole in firewalls, not very liked by security manager. But to the reverse tunnel direct to the laptop: how tell I the raspi that it should connect?
    – Ingo
    Jul 27, 2018 at 1:33
  • You can't connect without a hole in the firewall. That's what the firewall is there for.
    – svin83
    Jul 30, 2018 at 10:02
  • Crontab with "@reboot autossh....." works great.
    – svin83
    Jul 30, 2018 at 10:03
  • Why taking about crontab? That it works great isn't always true. On this site are many questions that it suddenly breaks. Man 5 crontab says: "Please note that startup, as far as @reboot is concerned, is the time when the cron(8) daemon startup. In particular, it may be before some system daemons, or other facilities, were startup. This is due to the boot order sequence of the machine." With systemd boot order sequence isn't defined and may change randomly.
    – Ingo
    Jul 30, 2018 at 10:20
  • Lots of ways to work around this. crontab is reliable, but the boot order, as you mention, could pose a slight problem... Though it shouldn't be a problem if you enable wait for network in raspi-config (if I'm not mistaken?). I've certainly never had any problems. You could even use something like '@reboot sleep 120; autossh...' to be sure. This is an ugly hack imho, but will delay autossh for 2 minutes, and should ensure the system is up and running before starting autossh.
    – svin83
    Jul 30, 2018 at 15:36
0

The reverse tunnel should work. If you ssh with a reverse tunnel from your rpi to your laptop (the ssh connection0 then a port will be open on the laptop so that when you connect to said port of the laptop (either from the laptop itself or another computer that has access to the laptop, it really depends on how you try to set up the reverse tunnel and the ssh service restrictions on the laptop) then you will connect to some host/port on the rpi side (which very well could be some service of the rpi itself). This all depends on the laptop being reachable from the rpi. If your laptop has a public IP address then you should not have any problem at all.... however, if you are talking about connection to your laptop (or from your laptop with the ssh tunnel already set up, anyway) anywhere, even behind proxies and stuff (as in when you are at a private LAN), then you need both computers (rpi and laptop) on a different set up.

It might sound like an over kill but have you considered setting up a server on a VM provider so that you can access it with your rpi and your laptop so that they can see each other on a VPN? That should be enough.

Improve this answer
1
  • If you want to poke a hole into the firewall and do not use port forwarding then the only solution is to use a third machine in the internet. I have rent the smallest possible virtual server at my provider for about 70 € a year. That's payable for the comfort and security the reverse tunnel has. I can connect all over the world to this virtual server and its secure encrypted entry point of the revers tunnel to my home server.
    – Ingo
    Jul 11, 2018 at 1:21
0

Accessing your RaspberryPi ( or even laptops/servers) from outside your home network (meaning, from the internet) is not an easy task, because your home laptop or RaspberryPi has only local IP address ( in the 10.x.x.x range or 192.168.x.x range). It doesn't have a Public IP address that is visible from the Internet.

The simple answer to your question is use free online services like SocketXP which provides a secure public tunnel endpoint to SSH into your RaspberryPi from outside the home network.

Full disclosure: I am the founder of SocketXP.

The reason I recommend, SocketXP ( a third party service and not a self-hosted service) is that when you use SSH over the internet, it is highly secure. No one could decrypt your data without knowing your private key. Why go through the pain of hosting your own VM in the cloud just for the sake of getting a Public IP ( to act like a fulcrum to login to your RPi.)

SocketXP provides a simple, secure and easy way to access your home RaspberryPi from the outside network. It give you a free public IP. With SSH your data is encrypted end-to-end. Even SocketXP cannot decrypt your data connection.

SocketXP doesn't require you to hack any settings in your WiFi router. It works out of the box. To know how to setup your RaspberryPi to SSH from outside, read this blog on how to remote SSH into your RaspberryPi using SocketXP.

How to setup SocketXP:

enter image description here

Step1: Install SocketXP client on your RaspberryPi using the following command.

$ curl -O https://portal.socketxp.com/download/linux/socketxp && chmod +wx socketxp && sudo mv socketxp /usr/local/bin

Step2: Connect SocketXP client with SocketXP Cloud Service using the following command. You need to register at https://portal.socketxp.com to get your unique auth-token.

$ socketxp -register "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE1NDk1MTg0MDAsImlkIjoiZ2FuZXNodmVscmFqYW5AZ21ha6K208n0.cB2uYevpH4lWIQGQUJdQ0eiEDqS8OiP_YOiqernnui3rjjadfadsfsfas34"

Step3: Get a public tunnel endpoint to access your RaspberryPi from the internet.

$ socketxp -connect tcp://localhost:22

Tunnel Access -> tunnel.socketxp.com:35277

Step4: SSH into your RaspberryPi from the internet using the following command.

$ ssh raspberry-username@tunnel.socketxp.com -p 35277

where "raspberry-username" is the username/password you use to SSH login to your RaspberryPi.

Improve this answer
1
  • Port forwarding will translate specified WAN IP port(s) <-> specified port(s) on specified LAN IP. The SocketXP endpoint is no more/less safe than forwarding an external port to port 22 on the Raspberry Pi. However, it is a good solution for people without access to the residential gateway. The most important things when exposing sockets to the world is : 1. Disable password logins fo ssh. 2. Disable ssh logins for default/built-in users like root and pi. 3. Enable only public-key logins.
    – svin83
    Sep 22, 2019 at 20:12
0

I know the original poster didn't want to use a third party service, but some are free and work really well.

Take PiTunnel.com for example. I needed to access a bunch of Pi's remotely. I set this up in a few minutes and had remote terminal, status monitoring, and tunnels to web server and vnc working in no time.

(Full disclosure, I'm the creator of PiTunnel and we created it specifically to solve this problem for ourselves and others looking to do the same thing)

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.