Setting up Office PC Server with Raspberry Pi: Multihop SSH Tunnel Reverse Forward Tunnel

You can securely access your office server from home by configuring a reverse SSH tunnel on the Raspberry Pi that forwards traffic through a multihop connection. This setup allows your home PC to connect to the Pi, which then establishes a persistent forward tunnel back to the office network. By leveraging standard SSH capabilities, you create a secure bridge without exposing ports directly to the public internet, ensuring your internal resources remain protected while remaining accessible for remote administration and file transfers.

Network Architecture and Prerequisites

Before configuring the tunnels, it is essential to understand the flow of data. The goal is to allow a client at home to reach a service behind a NAT or firewall in the office. The Raspberry Pi acts as the entry point from the home network and the exit point into the office network. You will need SSH access to both the Raspberry Pi and the target Office PC. Ensure that the Office PC has an SSH server installed and running, and that the Raspberry Pi has a static local IP address or a reliable hostname resolution method within the office network. The connection relies on two distinct tunnel types working in tandem. First, a reverse tunnel is established from the Raspberry Pi to the Office PC. This allows the Office PC to initiate connections back to the Pi. Second, a forward tunnel is configured on the client side to route traffic through this chain. This approach bypasses strict firewalls that might block incoming connections but allow outgoing SSH traffic. For more context on exposing local servers securely, you might find Expose Local Server on VPS Preserving Real Client IPs (OS Level) useful, as it discusses similar networking concepts in a cloud environment.

Configuring the Reverse Tunnel on the Raspberry Pi

The first step involves setting up the reverse tunnel on the Raspberry Pi. This command tells the SSH daemon on the Pi to listen on a specific port and forward any incoming connections to the Office PC. Log into your Raspberry Pi via SSH and execute the following command:

ssh -R 8080:localhost:22 user@office-pc-ip -N -f

In this command, -R 8080:localhost:22 specifies that port 8080 on the Pi should be forwarded to port 22 on the Office PC. The -N flag indicates that no remote command will be executed, and -f runs the process in the background. Replace user@office-pc-ip with the actual username and IP address of your Office PC. If the Office PC is not directly reachable due to NAT, you may need to adjust the destination host to match the Pi's perspective of the Office PC's network location. To ensure this tunnel persists after reboots, consider using a systemd service or a cron job with a watchdog script. This prevents the tunnel from dropping if the network fluctuates. Additionally, verify that the GatewayPorts option is enabled in the /etc/ssh/sshd_config file on the Raspberry Pi if you intend to bind the port to all interfaces rather than just localhost. However, binding to localhost is generally safer for security purposes.

Establishing the Multihop Forward Tunnel from Home

Once the reverse tunnel is active, you can establish the forward tunnel from your home computer. This step creates the multihop path. On your home machine, run the following SSH command:

ssh -L 9090:localhost:8080 pi@home-pi-ip

This command forwards port 9090 on your home PC to port 8080 on the Raspberry Pi. Since port 8080 on the Pi is already reversed to the Office PC's port 22, your home PC effectively connects to the Office PC's SSH service through the Pi. You can now use tools like scp or sftp by connecting to localhost:9090. For a more seamless experience, you can configure your SSH client settings in ~/.ssh/config on your home machine. Define a host alias that encapsulates the entire jump chain:

Host office-pc
    HostName office-pc-ip
    User office-user
    ProxyJump pi@home-pi-ip
    LocalForward 9090 localhost:22

This configuration simplifies subsequent connections. Instead of remembering complex command-line flags, you simply type ssh office-pc to connect. Note that the ProxyJump directive automatically handles the multihop logic, making it easier to manage than manual port forwarding commands.

Maintaining Stability and Security

Persistent connectivity is crucial for remote server management. Network interruptions can break SSH tunnels, leading to lost access. Implementing a keepalive mechanism helps maintain the connection. Add ServerAliveInterval 60 and ServerAliveCountMax 3 to your SSH client configuration. These settings send a null packet every 60 seconds, ensuring that intermediate firewalls do not drop the idle connection. Security should never be compromised for convenience. Use key-based authentication instead of passwords for all SSH connections. Disable password authentication in the sshd_config files on both the Raspberry Pi and the Office PC. Additionally, restrict SSH access to specific IP addresses if possible, or use fail2ban to protect against brute-force attacks. Regularly update the operating systems on both devices to patch any potential vulnerabilities.

Frequently Asked Questions

What happens if the Raspberry Pi loses power?

If the Pi loses power, the reverse tunnel breaks immediately, and you lose access to the Office PC until the Pi restarts and reconnects. To mitigate this, use a UPS (Uninterruptible Power Supply) for the Pi or configure a secondary fallback method, such as a direct cellular backup connection.

Can I use this setup for web services other than SSH?

Yes, you can forward any TCP port. Change the port numbers in the -R and -L flags to match the service you wish to expose, such as port 80 for HTTP or 443 for HTTPS. Just ensure that the destination service is listening on the correct port on the Office PC.

Is it safe to expose port 8080 on the Raspberry Pi?

Binding to localhost is safe because it only accepts connections from the local machine. If you must bind to all interfaces, restrict access using firewall rules like iptables or ufw to allow only trusted IP addresses. Never expose administrative ports to the public internet without additional encryption and authentication layers.

How do I debug a broken SSH tunnel?

Use the -v flag with the SSH command to increase verbosity. Check the system logs on both the Pi and the Office PC for errors. Verify that the reverse tunnel is active by running netstat -tuln on the Pi to confirm that port 8080 is listening.

Why does my connection drop after some time?

Connections often drop due to NAT timeout settings or firewall idle timeouts. Enabling ServerAliveInterval sends periodic keep-alive packets to prevent the connection from being considered idle. Adjust the interval based on your network provider's timeout policies.