SSH tunneling with MikrotTik router

5 Replies

image SSH tunneling offers a way for connecting computers behind restrictive firewall. I try to find information on the Internet, but found only a bit or incomplete information, so I’ve decided to put in here all steps needed to set up tunneling. Suppose we have the following scenario: we have an remote machine behind a firewall, out of our control. We also have a MikroTik router up and running. We need an access to remote machine.

Installing and setting up SSH

Installing SSH on Ubuntu Linux is very easy:

sudo aptitude install ssh

enter your administrator’s password and follow the installation instructions.

Setting up the remote machine

MikroTik supports DSA encrption by default, so on remote machnine we have to generate key pair:

ssh-keygen -t dsa

after that we have to copy generated file id_dsa.pub in folder .ssh, and set te appropriate attributes:

cp id_dsa.pub .ssh/id_dsa.pub

chmod 0600 .ssh/id_dsa.pub

Setting up MikroTik router:

image For authentication without password, we need to copy and setup public key on the router. In this example I’ve used a MikroTik’s proprietary GUI Winbox. From left side first select Files, which opens a new window and drag & drop previously generated key file id_dsa.pub. Then, select New terminal from the menu. In this window we can import our key file with command:

/user ssh-keys import user=admin public-key-file=id_dsa.pub

When import is completed, we have to allow port forwarding and password login:

/ip ssh edit forwarding-enabled (change it to yes)
/ip ssh edit always-allow-password-login (change it to yes)

Set up keep-alive intervals

On Ubuntu linux the ssh client’s options are located in file /etc/ssh/sshd_config . We need to edit file with super user privileges and find keep-alive setting:

sudo vi /etc/ssh/sshd_config

TCPKeepAlive yes

also for client setup we have to edit the file .ssh/ssh_config:

Host *
ServerAliveInterval 60

These settings should made our tunnel bullet-proof!

Setup a reverse tunneling:

When we need to access the client machine, behind firewall we need so-called “reverse tunneling” – it’s something like port forwarding. SSH protocol have this feature implemented, but when connection is lost, ssh daemon shuts down and cannot reconnect. To make automatic reconnect on connection loss we need autossh. It can be installed with aptitude like ssh. Here is an example of command line, used to setup remote machine’s port 22 to our router’s port 6500:

autossh -M 0 -q -N -o ServerAliveInterval 60 -o ServerAliveCountMax 3 -R ourhost.com:6500:localhost:22 admin@ourhost.com

These parameters need some explanation:

  • -M 0 turns autossh monitoring off. In practice this monitoring is useless, we only need to monitor ssh process health.
  • -N -o ServerAliveInterval 60 -o ServerAliveCountMax 3 instead of edit configuration files it better to pass keep-alive intervals directly to ssh. This guarantees that ssh received intervals correctly.
  • admin@ourhost.com – this is our MikroTik account.

We can put this command in /etc/rc.local file, to ensure it is started every time on boot.

How to use a tunnel

Just connect with ssh client, using remote machine credentials:

ssh –X remoteuser@ourhost.com:6500

and you get connection to remote machine as it was behind your router’s firewall. Easy, isn’t it?