如何搭建SSH隧道实现服务器反向SSH连接客户端？

Got it, let's tackle this reverse SSH tunnel scenario—this is actually a super common workaround when firewalls block inbound connections to your client, but let you initiate outbound SSH from client to server. Here's exactly how to make it work, step by step:

Since your client can initiate SSH connections to the server, we'll start here to create the reverse tunnel that "pokes a hole" back to your client.

Run this command on your client machine:

ssh -R 2222:localhost:22 your-server-username@your-server-ip

Let me break down what each part does:

• -R: This flag tells SSH to create a reverse port forward. Essentially, it maps a port on the server to a port on your client.
• 2222:localhost:22: This means "forward all traffic coming into port 2222 on the server to port 22 (the default SSH port) on the client's localhost."
• your-server-username@your-server-ip: Your credentials for connecting to the server via SSH (you'll need to enter your server password or use SSH keys, as usual).

When you run this, you'll be logged into the server as normal—but behind the scenes, the reverse tunnel is active.

Now that the tunnel is up, you can SSH from the server to the client using the forwarded port.

On your server machine, run:

ssh -p 2222 your-client-username@localhost

Again, quick breakdown:

• -p 2222: Specifies we're using port 2222 (the one we mapped via the reverse tunnel).
• your-client-username@localhost: Since the tunnel maps server's localhost:2222 to client's localhost:22, connecting to localhost on the server sends traffic straight to your client's SSH service.

You'll be prompted for your client's SSH password (or key passphrase) and then logged into your client—just like you initiated the connection directly!

If you want the tunnel to stay up even if the client disconnects temporarily or reboots, use autossh (a tool that monitors and restarts SSH tunnels automatically).

First, install autossh on your client (most package managers have it: sudo apt install autossh on Debian/Ubuntu, brew install autossh on macOS, etc.).

Then run this command on the client:

autossh -M 0 -o "ServerAliveInterval 30" -o "ServerAliveCountMax 3" -R 2222:localhost:22 your-server-username@your-server-ip

• -M 0: Disables autossh's monitoring port (we'll use SSH's built-in keepalive instead to avoid extra port usage).
• ServerAliveInterval 30: Tells SSH to send a keepalive packet every 30 seconds to the server.
• ServerAliveCountMax 3: If 3 keepalives fail in a row, SSH will disconnect and autossh will restart the tunnel.

• Make sure your client's SSH service is running and listening on localhost:22 (this is the default for most systems, but double-check with systemctl status sshd on Linux or sudo launchctl list | grep ssh on macOS).
• On the server, verify that AllowTcpForwarding yes is set in /etc/ssh/sshd_config (it's usually enabled by default, but if not, restart the sshd service after changing it).
• If you need other users on the server to access the tunnel, set GatewayPorts yes in the server's sshd_config (but if only you need to use it, the default GatewayPorts no is fine—since it only allows the server itself to access the forwarded port).
• Choose a port above 1024 (like 2222) if you're not running the tunnel as root—privileged ports (1-1023) require root access.

内容的提问来源于stack exchange，提问作者General Foch