0

I have a NAS in my living room with a bunch of services like GitLab, NextCloud, my personal Website etc. running on it. All these services are reachable via a reverse SSH tunnel between my Ionos VPS with a public IP address running the reverse proxy for my domain and my NAS. This works fine. However, I cannot for the life of me get a regular remote SSH connection from my terminal to the NAS to be established which means I have to SSH into the VPS first and then SSH into the NAS from there and can only use GitLab via HTTPS not SSH. Maybe someone here has an idea.

Here's my setup:
NAS (main user malik):
autossh unit:

[Unit] Description=Reverse SSH Tunnel to VPS After=network-online.target Wants=network-online.target [Service] User=malik Environment=HOME=/home/malik ExecStart=/usr/bin/autossh -M 0 -N \ -o "ServerAliveInterval 60" -o "ServerAliveCountMax 3" \ -i /home/malik/.ssh/vps_autossh \ -R 8080:localhost:80 \ -R 8443:localhost:443 \ -R 3001:localhost:3001 \ -R 8001:localhost:8000 \ -R 8099:localhost:8099 \ -R 8022:localhost:8022 \ -R 2222:localhost:2222\ [email protected] Restart=always RestartSec=10 [Install] WantedBy=multi-user.target 

SSHD config:

Include /etc/ssh/sshd_config.d/*.conf AuthorizedKeysFile .ssh/authorized_keys Subsystem sftp /usr/lib/ssh/sftp-server 

VPS:

Main user root for admin and restricted user tunneluser for reverse tunnels

SSHD config:

Include /etc/ssh/sshd_config.d/*.conf KbdInteractiveAuthentication no UsePAM yes AcceptEnv LANG LC_* Subsystem sftp /usr/lib/openssh/sftp-server ClientAliveInterval 120 PermitRootLogin yes Match User tunneluser PasswordAuthentication no AllowTcpForwarding yes GatewayPorts yes 

I use 8022 for GitLab SSH and 2222 for my main NAS user. It looks like everything is working:

root@my-vps:~# sudo netstat -tulnp | grep 8022 tcp 0 0 0.0.0.0:8022 0.0.0.0:* LISTEN 3546/sshd: tunnelus tcp6 0 0 :::8022 :::* LISTEN 3546/sshd: tunnelus root@my-vps:~# sudo netstat -tulnp | grep 2222 tcp 0 0 0.0.0.0:2222 0.0.0.0:* LISTEN 3627/sshd: tunnelus tcp6 0 0 :::2222 :::* LISTEN 3627/sshd: tunnelus 

When I try to connect from my laptop I get a network unreachable error:

ssh -p 2222 [email protected] ssh -p 8022 [email protected] telnet 212.227.63.142 2222 telnet 212.227.63.142 8022 

What am I doing wrong?

1 Answer 1

2

Found the solution. It's something Ionos does for added security. You have to manually allow this in the firewall tab on your VPS panel on the Ionos website. This is separate from your own firewall/iptables config.

1
  • 1
    Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center. Commented Jul 31 at 14:53

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.