"Meet in the middle" with SSH

Question

I have an interesting question regarding SSH. I have a machine at school that I'd like to be able to access from elsewhere. It's behind a firewall/NAT, so I can't get at it directly. I have a leased web server that I can SSH into from anywhere. I was wondering if I could do some voodoo with port forwarding to get to my machine at school via the web server. I think this comes down to whether you can do SSH "backwards," which may or may not be possible.

Basically:
Machine A can access Machine B
Machine C can also access Machine B
How can Machine A access Machine C?

Answer 1

As to "backward" SSH there's Reverse Remote Shell that I've been using for a while in a similar situation.

But here, some things should be clarified first:

1. What kind of access do you need? Are we talking about SSH only or you meant something else?
2. What's about this web server (B)? Can it access the destination (C) directly without problems (which is not possible from A)? Or is it only a problem of unknown/dynamic IP of the source machine (A)?

I presume that in a standard situation you're able to initiate outgoing connections from C without restrictions, and all new inbound traffic is filtered, right?

UPDATE:

In that case you could use Reverse Remote Shell to connect from C (school) to B (SSH account). Then logging in from A (home) to B over SSH you grab the reverse console access to C. Plus side of this is it should work on almost any configuration.

Major drawbacks:

1. It's SSH only plus things you can do when you have local access to C.
2. You implicitly trust B (that your session won't be stolen).

This is a bit cumbersome. It would be much easier to use SSH port forwarding for this, but that is sometimes blocked by universities/schools (at least from my experience). Please see if you can use it in your situation. Then an easier and more elegant solution should be possible.

Answer 2

Yes, you can do port forwarding using SSH to get access to your machine at school. What you'll have to do is:

1. From the machine at school, you issue the following command:

   ssh -R port_on_server:localhost:local_port user@server

2. From the machine at home you do:

   ssh -L local_port:locahost:port_on_server user@server

Now, you can access your local_port at your home machine and will be forwarded to local_port at the machine at school. For example, if local_port is 80, you would be able to type http://localhost/ on your web browser and access the web server running at the machine at school.