Reverse SSH Tunnel: Export Your Mac Laptop To The Internet

• A VM in public cloud: We need a public IP to do the proxy. Don’t worry, the resource overhead is very small.
• Root access of the VM: Need this to configure sshd, and/or iptables.

• Make sure, sshd config file contains GatewayPorts clientspecified.

# mac: vim /etc/sshd_config
# Ubuntu/CentOS: vim /etc/ssh/sshd_conf

• If the VM has iptables enabled, make sure it allows incoming traffic for port 40062 and 8088.

# Use ufw for Ubuntu env
ufw allow 40062/tcp
ufw allow 8088/tcp

# Or use iptables directly
iptables -A INPUT -i eth0 -p tcp --dport 40062 -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --dport 40062 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --dport 8088 -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --dport 8088 -j ACCEPT

We use 40062 to do ssh reverse tunnel, so that people can ssh to our laptop. About web services, we start apache in laptop. It listens on port 80. Then do port forwarding from 8088 to 80 in this VM.

For better security, you only allow traffic from trusted source ip address.

For security concern, Mac OS doesn’t enable ssh remote login. Let’s turn it on: System Preferences -> Sharing -> Remote Login. Then verify by “telnet localhost 22“.

# Replace below with your VM's public IP
export vm_ip=YOUR_VM_IP

# Perform ssh reverse tunnel
# Parameters: -R(reverse tunnel), -4(ipv4)
# Here we choose 40062 to do the tunnel.
ssh -4 -v -p 22 -fN \
-o "PubkeyAuthentication=yes" \
-o "StrictHostKeyChecking=false" \
-o "PasswordAuthentication=no" \
-o "ServerAliveInterval 60" \
-o "ServerAliveCountMax 3" \
-R $vm_ip:40062:localhost:22 root@$vm_ip

# Verify connection
telnet $vm_ip 40062

Show Time! Run this: ssh -p 40062 root@$vm_ip from any machine. Input root password of your laptop. Then people can ssh your laptop now!

We want to simulate how to export web services. Mac OS X preinstalls apache.

Let’s start apache in our laptop.

# Start apache service in mac
sudo apachectl start

# Verify apache works
curl http://localhost

In VM, do ssh tunnel from $vm_ip:8088 to port 80 in our laptop.

# ssh tunnel for port forwarding
ssh -v -N -p 40062 -f root@$vm_ip \
-L *:8088:localhost:80 -n /bin/bash

In any other machines, visit http://$vm_ip:8088 in web browser.

• Disable Remote Login in system setting.
• Simply kill process in your laptop, which runs ssh reverse tunnel.

# Find pid in mac
ps -ef | grep 40062

# Kill process. If it fails, use 'kill -9'
kill $pid

# Verify it's done

ps -ef | grep 40062

telnet $vm_ip 40062

Quite natural, ssh connection may break up in our laptop. Network turbulence or the computer goes to idle or hibernate.

autossh: Automatically restart SSH sessions and tunnels[1]. Let’s do the auto connection by autossh[2].

# Install autossh
brew install autossh

# Verify installation
which autossh

To take effect, let’s make a small change in Step #2 of ssh reverse tunnel.

From:

ssh -4 -v -p 22 -fN \
-o "PubkeyAuthentication=yes" \
-o "StrictHostKeyChecking=false" \
-o "PasswordAuthentication=no" \
-o "ServerAliveInterval 60" \
-o "ServerAliveCountMax 3" \
-R $vm_ip:40062:localhost:22 root@$vm_ip

autossh -M 40063 -4 -v -p 22 -fN \
-o "PubkeyAuthentication=yes" \
-o "StrictHostKeyChecking=false" \
-o "PasswordAuthentication=no" \
-o "ServerAliveInterval 60" \
-o "ServerAliveCountMax 3" \
-R $vm_ip:40062:localhost:22 root@$vm_ip

Make sure:

• Your VM won’t block the traffic of port 40063.
• You can ssh to VM by key file, without typing password in the terminal.

Let’s verify the change, by telnet $vm_ip 40062.

[1] http://www.harding.motd.ca/autossh/
[2] www.everythingcli.org/ssh-tunnelling-for-fun-and-profit-autossh/

More Reading: Deploy Your Static Or Dynamic Websites Using Git In Public Cloud.

Blog URL: https://www.dennyzhang.com/export_mac_laptop