0

I need to be able to access an IP camera that is on the same local network as a raspberry. I do not have access from the outside because it is a mobile data network that does not give me public IP or I can do NAT. I was thinking of creating a ssh reverse tunnel against a server on internet (Virtual Private Server). I would like that from any internet PC could put a domain with a port and redirected me to the web that is serving the IP camera, and this should be through the raspberry.

I was testing with iptables and ssh reverse tunnel but although the local port fordwaring works, the reverse tunnel didn't. I've tried with

sysctl net.ipv4.ip_forward=1
sudo iptables -t nat -A PREROUTING -p tcp --dport 1111 -j DNAT --to-destination 192.168.1.192:80
sudo iptables -t nat -A PREROUTING -p tcp --dport 1111 -j DNAT --to-destination 192.168.1.192:80

ssh -f -N -T -R22222:localhost:1111 [email protected]

Nothing happens if I try with http://myvps.com:22222

Thank you very much

Improve this question
2
  • Just to understand it right: the RasPi is mobile (with its local network and camera). From any location it establishes a reverse tunnel to always the same relay server on the internet with public ip address. The relay server opens a port that is the endpoint of the revers tunnel from the RasPi. So any laptop everywhere can connect with ssh to the port on the relay server and get through the tunnel to your RasPi. This is the classic usage of a reverse tunnel. Is it this what you want?
    – Ingo
    Aug 20, 2018 at 23:05
  • I have put this question out of focus. If you like to get help please address me with @Ingo
    – Ingo
    Aug 27, 2018 at 10:18

1 Answer 1

Reset to default
3

Why use iptables at all if you want a ssh reverse tunnel?

Use

ssh -g -f -N -T -R22222:192.168.1.192:80 [email protected]

Assuming that 192.168.1.192:80 is the address of your camera and port 22222 is the port to listen on the remote server. No iptables, no forwarding needed for this.

You may need to allow the option -g on the server, see sshd_config, set GatewayPorts to yes.

Improve this answer
3
  • Thanks for your answer, but I can't connect to camera with http://myvps.com:22222. The error is HTTP ERROR 504. Why iptables? to redirect the traffic when it reaches the raspberry (newbie solution maybe). I have taken a look at the system log (myvps) and I have not found anything relevant
    – crossmax
    Aug 19, 2018 at 14:56
  • The HTTP ERROR 504 should come from your camera. Run tcpdump -n -X -s1500 -iany host 192.168.1.192 and port 80. It should show you the traffic sent to the camera and the response. Maybe the response contains more details than ERROR. Also the camera may have some logs.
    – RalfFriedl
    Aug 19, 2018 at 14:59
  • Thank you this was my savior. Puzzled for 30 min futzing with iptables before I found this about GatewayPorts and -g.
    – jchook
    Feb 14, 2019 at 0:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.