Set up direct SSH connection from A to C without public IPs using one public SSH server

Question

I have available these SSH servers/clients:

A - without public IP

B - public IP

C - without public IP

I know, I can establish an SSH connection from A to C as follows:

1) Hook C to B. Doing from C:

ssh -R 10100:localhost:22 B_IP

2) Set port forwarding from A to C using B hook in order to be able of ssh-agent usage on machine A:

ssh -L 5000:localhost:10100 B_IP

3) Now I can use my ssh keys to "directly" access C from A:

ssh -p 5000 localhost

... my point is:

Can I somehow establish new "pure" connection from A to C so that after machine B goes down, I can continue my work?

I think it should be possible as long, as these two computers realise, they already share a connection, or am I wrong?

Thanks for your time & ideas :)

Answer 1

• The usual method is to set up "NAT port forwarding" on A's or C's router. (How it's done depends on router, but there are instructions everywhere.) Once you do that, you can connect to C-router's public address + the "forwarded" port, and the connection will go through to C.

  (Note: NAT port-forwarding and SSH port-forwarding are similar but distinct things, like a hammer and a screwdriver. Do not confuse them.)

• If you do not have administrative access to either router, you could try using UPnP or NAT-PMP to set up a port forwarding rule, as many games and P2P programs do. For this, use upnpc or natpmpc commands.

• If neither of above methods work, you will need some form of NAT hole-punching. (See also the TCP and ICMP hole-punching articles.)

  Unfortunately, while it's widely used in various specific programs, there don't seem to be many generic tools for TCP, though chownat may work.

Answer 2

This is probably impossible unless you can do some kind of port forwarding on the routers - but in this case you don't need computer C at all.

The thing is that in your example you are not going directly from A -> C, the packets are all still traversing B.

If you have another computer with public addresses on it, you can probably set up a VPN setup in a star topography, and use routing between the VPN's to create a virtual network where either of the public hosts can fall over and things can continue to work. I've done this with OpenVPN - there are a few gotchas - one important one being disabling Reverse Path Filtering.