For helping others quickly, SSH is very useful, especially combined with GNU Screen. It's common that users are behind a NAT router. Even if the user can configure the router, it takes some time to remember the password, find the right options, etc.

So, what is the easiest way to help others over SSH if they're behind a NAT router?

I currently tell people to open a terminal run the below command and pass me their IP from a site like http://ip.appspot.com/:

sudo apt-get install openssh-server ssh-import-id && ssh-import-id lekensteyn

Obviously, this is not going to work if they're behind a NAT router or have a personal firewall configured. So, is there something like:

sshd --accept-help-from lekensteyn

I'm not looking for alternatives like Teamviewer, just a shell like SSH. It should be open-source too.


4 Answers 4


If your own computer can accept SSH connections, there is a way to use the technique that Pavlos G. linked to without an extra computer.

You first need an underprivileged* user that your friend will connect as:

sudo adduser reverse --shell /bin/false

Tell your friend to start the tunnel:

ssh -N -R 62222:localhost:22 reverse@lekensteyns-server

Then, on your own computer (lekensteyns-server), start the reverse connection:

ssh -p 62222 localhost

* I don't know enough about security to be able to advise on creating a suitably underprivileged user. That's probably something that should be covered in a separate question.


Based on your specific needs, i would probably:

  1. Ask them to tell me the router's password
  2. Login and setup port-forwarding for port 22 only
  3. Connect through SSH (or SSH tunneling if you need extra ports opened) and get the job done.

I also forgot that you can try the reverse ssh tunnel, although this solution technically needs one more - middle - computer to work.

More info can be found here

  • 1
    1) is probably not going to work since router access is often prohibited for the public.
    – Lekensteyn
    Jun 10, 2011 at 19:43

I just usually set up an IPv6 tunnel (from sixxs.net or he.net) if they don't already have IPv6 and then that way the computer has a static address and I don't have to mess with NAT. I also like to set up key based authentication (then they don't have to tell you their password).

Sixxs has their own client that you use. It works behind almost any NAT, and automatically updates when the IPv4 address changes. They have instructions on how to set it up and it is packaged for Ubuntu.

Hurricane Electric uses a tunnel where IPv6 packages are sent as the payload of a IPv4 packet. Unlike Sixxs, no TCP/UDP is used. This means that the NAT you are behind has to support forwarding PROTOCOL 41 (not port) and only one computer behind the NAT can use it. The software to use a tunnel like this is built into Ubuntu.

For HE, I use something like this in /etc/network/interfaces:

auto he-ipv6
iface he-ipv6 inet6 v4tunnel
     address  2001:470:a29f::2
     netmask  64
     ttl 64
     up ip -6 route add default dev he-ipv6
     down ip -6 route del default dev he-ipv6

The other thing you need to do is update your tunnel endpoint. Since you do not know when the External IP changes, you will have to just try to update the endpoint every few minutes. You could use something like this and run it from cron:

echo -n "Hurricane Electric Proto-41 tunnel endpoint update: "
#(C) 2010 Erik B. Andersen This script is licensed under the latest version of the
# AGPL published by the Free Software Foundation at http://www.gnu.org/licenses/ .
####Set these for each different site#########
####Past here doesn't need to be changed######
wget -4 "https://ipv4.tunnelbroker.net/ipv4_end.php?ipv4b=AUTO&pass=$(echo -n "${pass}" | md5sum | grep -o -E "[0-9a-fA-F]{32}")&user_id=${user_id}&tunnel_id=${tunnel_id}" -O /dev/null -o /dev/null --no-check-certificate
echo " Done"
  • 1
    What efforts need to be done to set up such a tunnel correctly? This connection is of course key-based, that's why I use ssh-import-id
    – Lekensteyn
    Jun 11, 2011 at 8:33
  • Indeed, I'd love to learn more about this trick. Feb 17, 2012 at 22:19

Along the years, I developed a GUI to do exactly what the OP asks... except that it requires a ssh access to a third server with public IP, as suggested by Pavlos. You can find here the debian packages and the instructions:


Notice it (still) is not able to take care of the initial configuration - namely, you have to setup yourself the rsa keys for passwordless connection. Once set up, "reachthem" allows you to see whether "reachme" is connected, and to open an ssh shell/browse the filesystem/view the screen (experimental).

Clearly, you don't need a third computer if your computer itself has a public IP, as in the answer by ændrük. And clearly, the benefit of the GUI is that the remote user doesn't have to enter any command in a terminal... but part of this benefit is lost if the remote user has to install reachme. So I just always install and set up reachme to everybody I install Ubuntu to.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.