Implementation of Intranet Penetration based on SSH Port forwarding

The machines in our local area network can access the external network, but the external network cannot access the internal network. Because the internal network can determine the address of the external network when accessing the Internet, but the external network can not determine the specific address in our local area network. (limited ip address) if this link keeps him continuous when we visit the public network, then this link is tantamount to building a way for us to build a way in which the data of the internal network can go out and the data of the external network can enter, and ssh is the same method.

Use the ssh command to link to the public network server

1. First edit the configuration file of sshd on the public network server

Vim / etc/ssh/sshd_config# turn on the GatewayPorts switch to restart the sshd service with GatewayPorts yes, and use the modification to take effect (commands may vary with different versions of linux) systemctl restart sshd

2. Command

Ssh-NTf-R: user@hostlocal-host can be omitted, for example: ssh-NTf-R 8888 user@hostlocal-host 127.0.0.1 user@hostlocal-host

3. Parameter description

-C allows data to be compressed

-f running in the background

-N means only the remote host is connected, and the remote shell is not opened.

-R binds the port to the remote server, reverse proxy

-L binds the port to the local client, forward proxy

-T does not assign TTY to this connection

-NT represents that this SSH connection is only used to transmit data and does not perform remote operations.

Keep ssh links open

Usually when we use ssh to link to the server, if we do not operate for a long time, the link will be closed.

Method 1. Set up the client

1) user-level settings

Vim ~ / .ssh / config (if you don't have a config to create one)

2) Global Settin

/ etc/ssh/ssh_config

Just select one of them and add the following parameters

# send an empty packet to the server every 60 seconds ServerAliveInterval 6 "disconnect ServerAliveCountMax if it is not successful more than two times" and exit after forwarding failure to facilitate the reconstruction of connection ExitOnForwardFailure yes

Temporary writing (recommended, does not affect others)

Ssh-o ServerAliveInterval=30 root@hostssh-NTf-R 8888 root@host-o ServerAliveInterval=30-o ServerAliveCountMax=2

Method 2. Set up the server side

Vim / etc/ssh/sshd_config# every 30 seconds, the server sends a heartbeat to the client. After the heartbeat does not respond for 3 times, the server will think that Client has disconnected ClientAliveCountMax 3.

Method 3. Use shell script

Touch myAutoSSH.sh because I set the ssh connection to be rsa secret-free authentication, so the logic here does not need a password

Ssh secret-free login method

While (1) do ssh-NTR: user@hostdone

Make sure that you can connect immediately after the disconnection and remove the-f parameter, otherwise the cycle will be dead.

Method 4. Use autossh

You need to download autossh software, which is similar to using ssh directly.

-M is the listening port to listen to whether the command is unresponsive and to help us keep the link.

Autossh-M 5678-NTR: user@host

I don't like downloading software-there are a lot of messy software, and I don't like to modify the configuration-for fear of affecting other people's use after modification, so I like to use temporary configuration on the client side.

The above is the whole content of this article, I hope it will be helpful to your study, and I also hope that you will support it.