How to ssh to device wich is connected via vpn to server

Question

I have a laptop, a server(static IP) and a PC (dynamic IP). The PC is connected to the server via OpenVPN service. I want to use this to SSH from my laptop to this PC via server. I assume this is the easiest way to SSH to this computer given it uses a dynamic IP address. Is it possible? If yes, how can it be done?

Answer 1

Since the PC has a dynamic address, it must be assigned a hostname.

1. If the dynamic IP is internal to your network and you control the DHCP/DNS server such as Dnsmasq, you can make it assign a hostname.
2. If the dynamic IP is ISP-assigned, use a DDNS service such as DynDNS to assign your PC a hostname.

Once your PC has a proper hostname, you can setup your server as the SSH jumphost:

1. Install your laptop's public SSH key in the server and the PC.

2. In your laptop's ~/.ssh/config, add the following

   Host <PC_hostname>
   ProxyJump <server_hostname>
   

There are 2 alternatives that don't use DDNS.

Make the PC dump its IP in the server:

1. PC dumps its IP in user@server:~/pc-ip-addr.txt at 1-minute intervals.
2. In the laptop, read the file and SSH to the PC's IP.

Make PC maintain a permanent SSH connection to server:

1. In the PC, ssh user@server -R 2222:localhost:2222
2. In the laptop, ssh user@server "ssh user@localhost -p2222"

Answer 2

When you set up an OpenVPN connection it creates an additional IP address on each device. The easiest way would be to establish the OpenVPN address of the PC and connect to it on that IP address after establishing OpenVPN.

It may also be possible to instruct the OpenVPN to advertise the internal LAN routes across the VPN, and connect to the computers Internal IP address - the difficulty you will have here is establishing what the computers Internal IP address is - you probably cant use dynamic DNS services here because they will pick up the external IP address rather then the computers internal IP address. You could always statically assign an address to the computer - either directly or by instructing the router to dynamically assign a static IP address to the computer based on its MAC address.