0

I need to be able to access an IP camera that is on the same local network as a raspberry. I do not have access from the outside because it is a mobile data network that does not give me public IP or I can do NAT. I was thinking of creating a ssh reverse tunnel against a server on internet (Virtual Private Server). I would like that from any internet PC could put a domain with a port and redirected me to the web that is serving the IP camera, and this should be through the raspberry.

I was testing with iptables and ssh reverse tunnel but although the local port fordwaring works, the reverse tunnel didn't. I've tried with

sysctl net.ipv4.ip_forward=1
sudo iptables -t nat -A PREROUTING -p tcp --dport 1111 -j DNAT --to-destination 192.168.1.192:80
sudo iptables -t nat -A PREROUTING -p tcp --dport 1111 -j DNAT --to-destination 192.168.1.192:80

ssh -f -N -T -R22222:localhost:1111 user@myvps.com

Nothing happens if I try with http://myvps.com:22222

Thank you very much

  • Just to understand it right: the RasPi is mobile (with its local network and camera). From any location it establishes a reverse tunnel to always the same relay server on the internet with public ip address. The relay server opens a port that is the endpoint of the revers tunnel from the RasPi. So any laptop everywhere can connect with ssh to the port on the relay server and get through the tunnel to your RasPi. This is the classic usage of a reverse tunnel. Is it this what you want? – Ingo Aug 20 '18 at 23:05
  • I have put this question out of focus. If you like to get help please address me with @Ingo – Ingo Aug 27 '18 at 10:18
2

Why use iptables at all if you want a ssh reverse tunnel?

Use

ssh -g -f -N -T -R22222:192.168.1.192:80 user@myvps.com

Assuming that 192.168.1.192:80 is the address of your camera and port 22222 is the port to listen on the remote server. No iptables, no forwarding needed for this.

You may need to allow the option -g on the server, see sshd_config, set GatewayPorts to yes.

  • Thanks for your answer, but I can't connect to camera with http://myvps.com:22222. The error is HTTP ERROR 504. Why iptables? to redirect the traffic when it reaches the raspberry (newbie solution maybe). I have taken a look at the system log (myvps) and I have not found anything relevant – crossmax Aug 19 '18 at 14:56
  • The HTTP ERROR 504 should come from your camera. Run tcpdump -n -X -s1500 -iany host 192.168.1.192 and port 80. It should show you the traffic sent to the camera and the response. Maybe the response contains more details than ERROR. Also the camera may have some logs. – RalfFriedl Aug 19 '18 at 14:59
  • Thank you this was my savior. Puzzled for 30 min futzing with iptables before I found this about GatewayPorts and -g. – jchook Feb 14 at 0:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.