Re: SSH connection through a router applying NAT



Marco <netuse@xxxxxxxxxxx> wrote:
I want to be able to connect to my home computer via SSH from
the outside.

The problem is that I am behind a NAT. [...]

I have no access to the router [...]

Given these constraints you CANNOT directly get to your home computer
from outside. The only solution is for your own machine to establish a
connection to someone on the outside and use that connection to tunnel
back in again.

One option is to configure your "outside" machine to use one of the
DDNS services (such as dyndns.org) to track its IP address. Then you
can use OpenVPN from your home machine to your dyndns.org based system
to establish the connection. This presupposes that your outside machine
is not behind NAT but is directly on the Internet. If both systems are
behind NAT then you can consider the game over.

There are two important caveats with this:
1. You should use UDP connections with OpenVPN (rather than TCP)
2. You should set the "--float" option, and have the --keepalive
(ping and ping-restart) option quite high - I'd recommend
"--keepalive 120 300".

The reasons behind this are principally so that you don't spray other
users of your dynamic address space with your OpenVPN data packets. The
down-side is that it will take up to five minutes for your home server
to connect to your outside machine. (Remember: the average connection
time will be only 2.5 minutes, though.)

Chris
.



Relevant Pages

  • Re: Processs PreciseMail AntiSpam Gateway - any experience so far ?
    ... Client sending system ... >> ISP using dynamic NAT with port overloading. ... >> 10.11.12.1 is the clients real address and it opens a connection from its port ...
    (comp.os.vms)
  • Re: WinRoute Pro
    ... If a RST is sent to a TCP protocol host, ... 1/ Check the NAT table. ... 2/ Open a TCP connection to a host using a port tool. ... Winroute's logs are no substitute for a decent packet sniffer. ...
    (comp.security.firewalls)
  • Re: Establish external trust over a NAT device
    ... suggesting hardware over Windows built-in functionality for a VPN solution. ... even a fairly cheap router will likely have much better throughput ... L2TP and routing over it with or without NAT on that connection. ...
    (microsoft.public.win2000.active_directory)
  • Re: NAT and keepaliveopen connection over TCP
    ... sent after 10 minutes of inactivity on the TCP connection. ... There's no minimum set time how long a NAT router should ... time-out inactive connections at the server. ...
    (microsoft.public.win32.programmer.networks)
  • Re: Microsoft Worm
    ... > securing their machines and who require full access to the internet. ... > every provider imposed NAT on their customers and started blocking ports, ... As for NAT, I've always had a NAT system on my home internet connection ...
    (alt.computer.security)