Create Reverse SSH Tunel for connection over NAT

Question

Hello how can i create a working Reverse ssh tunnel like this commend should do:

ssh -fN -R 12345:localhost:22 internediary_user@192.168.2.45

This create the process on the intermediary computer.

This code in in test state so this is the reson why i use private ip for home user. I would like to test before i try it on public server.

So the working part is: I can locate the success LISSENING port in intermediar computer named sshd.exe and with localport 1234;remote port:22.
It looks good.

But instead of adding rule for eneble 12345 port tcp on the firewall with inbould direction. The port scan from 3th Computer on the network show port is refuses conenctions.

So here i got stuck. From 3th computer say in time ssh connection attempt to connect to destination computer throught intermediary computer: Connection refused.

As far as i know it would work but not work. Naturaly the public authentication work seemless and with normal ssh completely work the login.
Althought I may locate an error when i run that command. The command not completed just run. ' _ ' blicking infinity till not close the cmd window

Answer 1

NAT located on the computer that i want to manage. So NAT rules only say i block and drop all inbound package but outbound still goes out. Therefore remote computer throught relay server (public ip and allowed incomming rule for manage ssh tunnel) able to connect to remote host.

So it is a Windows computer so please not send me linux commands. And it is a Home computer but the relay server is an EC2 Amazon linux server. Problame with this only that this plan allow limited network resources and what is more important the bandwith limit is so little. Only command base management without GUI has worth.

And the above command can be modify to do that:

ssh -fN -R 100.100.100.1:12345:localhost:22 ******@18.45.23.XX -P 4567

So if we interpret this it say: forward from 100.100.100.1:12345 to localhost:22 (that is the relay server internal or Nat network's address) by authentication data of relay server on 4567 ssh port (conenctions started from HOST not from client where we want to conenct back to tunnel other End-point. ).

And when we initialize the ssh connection from remote client we will call the 18.45.23.XX where gatway will forward to internal 100.100.100.1 that is return back to Host ssh tunel original end.
If we want to wrap some protocol inside the SSH tunel we also need an Loopback adapter on HOST. Tested with SMB. Connection encrypted all the way of route. The protection only depends from private key complexity, so from the key managment. Even if the network is attacked the enscripted data stay enscripted if you not cashed that sensitive information or laked wherewith able the attacker to descript anything.