Remote desktop over SSH reverse tunnel to replace TeamViewer

ssh ssh-tunneling remote-desktop netcat

12,482

Solution 1

Can you try doing the second step without doing the nc? That is - do the VNC with just the -L and -R. I believe the issue is that your netcat session is connecting back to an already open. So when doing the VNC stuff don't use netcat.

Solution 2

Instead of ProxyCommand, you should set "gatewayports yes" for your middleman sshd.conf.

Then take remote tunnel from desktop to middleman and opening the tcp port x in middleman and vnc on local.
Then take local tunnel from laptop to middleman opening vnc port to you localhost and tunneling it to x.
Then connect to localhost:vnc, so it will go via local tunnel to middleman and remote tunnel to laptops vnc.

After you get it working, learn more about more secure settings of gatewayports.

12,482

Jarek

You may be interested in the story of SE moderator Monica Cellio and how she was unfairly treated by the corporate management of this site. More info here. An update is available. Let's hope we can cultivate a more fair environment for content creators and moderators going forward.

Updated on September 18, 2022

Comments

Jarek over 1 year
I want to open a remote desktop session from my laptop to desktop over my SSH (reverse) tunnel. That should be simple (or at least doable), right? Until now I've been using Team Viewer to log in to the remote desktop. I'd like to achieve similar results without Team Viewer.

Here's what my SSH tunnel looks like:
```
laptop--->nat--->middleman<--nat<--desktop
```
All machines are running Linux (mostly Kubuntu 12.04 or OpenSuse 12.3). I cannot change any ports or make any configuration changes on the nat routers.

I'll describe my SSH tunnel because understanding that appears to be necessary in solving the VNC / remote desktop issue that is the heart of my question. Regarding this leg:
```
middleman<--nat<--desktop
```
...here is how it is established:
```
autossh -M 5234 -N -f -R 1234:localhost:22 [email protected]
```
Regarding this leg:
```
laptop--->nat--->middleman
```
I can connect to middleman as follows:
```
me@laptop:~$ ssh -i ~/.ssh/id_rsa admin@middleman  
```
However, what I actually need to do is connect directly to the desktop, not to the middleman. To do that I use netcat ("nc") on middleman. Based on this it appears that nc is required. So I edit my SSH config file on laptop to use ProxyCommand and nc:
```
me@laptop:~/.ssh$ nano config
```
The contents are:
```
Host family_desktops
  ProxyCommand ssh middleman_fqdn nc localhost %p
  User admin
  PasswordAuthentication no
  IdentityFile ~/.ssh/my_id_rsa
```
Where middleman_fqdn is like "middleman.com"

Then I just connect to "desktop" in one step:
```
me@laptop:~$ ssh family_desktops -p 1234
```
(I got this working based on help here and here and other related questions I asked. I have asked a ton of questions on this topic because I have been wresting with it for many weeks.)

With this SSH connection I reach a fully functioning shell on my computer labeled desktop. Perfect.

Now I just need a VNC-like (or TeamViewer-like) remote desktop solution over this SSH tunnel. How?

Here is what I have tried so far:

middleman<--nat<--desktop
```
autossh -M 5235 -N -f -R 1235:localhost:5901 [email protected]
```
with that connection established:
```
x11vnc -autoport 5901 
```
I watch to make sure it connects to port 5901, which it does.

laptop--->nat--->middleman<--nat<--desktop

laptop ~/.ssh/config:
```
Host family_desktops
  ProxyCommand ssh -NL 5901:localhost:1235 middleman.com nc localhost 1235
  User admin
  PasswordAuthentication no
  IdentityFile ~/.ssh/my_id_rsa
```
Tunnel setup:
```
me@laptop:~$ sudo ssh family_desktops
```
VNC client:
```
connect to localhost:5901
```
This gives an error of "server not found"

I have tried a number of variations on the ProxyCommand, none of them successful. Obviously, I'm guessing about which parameters should be in ProxyCommand and which should be on the ssh command line. I can see some potential problems with my setup, but I haven't been able to figure out what will make it all work.

P.S. As mentioned, I have asked several questions about this. Some of those led me closer to the solution and form the basis of my present question. Other of my prior questions on this topic just show my ignorance and inability to ask the question in the right form. At this point, this present question represents my best ability to state what my problem is and what my desired solution is, but some of my other questions are still open too. Here's one that is relevant.
- Marco almost 11 years
  
  Side note: Please do not use “here” or “this” links. Provide a meaningful name for your links, e.g. the title of the question or web page you link to.
- slm almost 11 years
  
  Didn't you ask this question before? unix.stackexchange.com/questions/82255/…
- Jarek almost 11 years
  
  @slm - see some of the links in my question. They are some of my related questions. I'm still trying to achieve a solution and each question seems to be getting me closer...
- Tim almost 11 years
  
  This seems incredibly convoluted. I use the remote desktop of my Windows 8 machine by SSH'ing to a machine also on the same network that has a port open in the firewall to it.
- Jarek almost 11 years
  
  @Tim this is a reverse SSH tunnel and it is required because desktop is behind a NAT router and laptop is behind a NAT router.
- Jarek almost 11 years
  
  @Marco The full and meaningful name of the links is provided in the side bar to the right of the article. However, in most cases, I also agree with you, but my question is already so long I used short link names on purpose this time.
- prateek61 almost 11 years
  
  Can you try doing the second step without doing the nc? That is - do the VNC with just the -L and -R. I believe the issue is that your netcat session is connecting back to an already open. So when doing the VNC stuff don't use netcat.
- Jarek almost 11 years
  
  @prateek61 - Thanks! I got it working without nc. :-) But vnc is a lot slower than TeamViewer. It's almost unusable. Hopefully I can tweak the settings and get it much better. But I'm very happy to have solved this after a lot of work. Thank you.
- prateek61 almost 11 years
  
  Hey - just to give you a heads up, VNC is generally slow. I have tried a lot to adjust settings but sometimes even on a direct connection it is pretty slow. I would try freenx.berlios.de if you want something a little faster.
- Jarek almost 11 years
  
  @prateek61 - I had been reading all the marketing claims about VNC and they gave me the impression it would be fast. Regarding NX, I had read that the server component has to have a public IP address. But after reading your comment I just found NoMachine over SSH/Netcat proxy. So I guess I will try that next.
- Jarek almost 11 years
  
  @prateek61 - if you answer this question I'll accept your answer since your comment helped me solve it.