Using reverse SSH tunnel to access Blue Iris behind CGNAT

[danivilo]

Hi All!

I am trying to setup a reverse SSH tunnel to access a Blue Iris server that sits behind CGNAT. (No port forwarding, DDNS etc.) I already have machine access through RDP but I would also like web access.

From the Blue Iris server I issue the command:

ssh -N -R 8181:localhost:81 me@my.vps.machine.com

When browsing to my.vps.machine.com:8181 I get ERR_CONNECTION_REFUSED.

The Blue Iris server is (for now) also running Apache and if issuing the command:

ssh -N -R 8181:localhost:80 me@my.vps.machine.com

I get the website served perfectly when visiting my.vps.machine.com:8181.

I have tried using nginx on the VPS in conjunction with the reverse SSH tunnel to forward (proxy_pass) a my.vps.machine.com request to 127.0.0.1:8181 which results in 502 BAD GATEWAY.

The nginx method works when connecting to my Apache server on port 80.

I have tried running Blue Iris server on port 80 with same result.

I have not been able to access any Blue Iris web server logs as I cannot find any. How do you enable web server log?

Does anyone know how to get around this issue? Could it have anything to do with the "Remote, external (WAN/Internet) access" setting in Blue Iris? I have tried different options here: local IP, VPS IP NAT IP but nothing works so far.

Thanks!

 

[danivilo]

Found a solution!

Instead of

ssh -N -R 8181:localhost:81 me@my.vps.machine.com

from Blue Iris server i did

ssh -N -R 8181:192.168.xxx.xxx:81 me@my.vps.machine.com (using local server LAN IP)

Now it works!

To setup a static tunnel you can use something like Bitvise SSH Client | Bitvise or

 

[tangent]

Glad you got it working. Another option is ngrok - secure introspectable tunnels to localhost

 

[danivilo]

Thanks tangent. I looked into ngrok but it seemed quite complex to run it self hosted. As I already have a VPS I don't want to pay for a service that can be accomplished without spending more on monthly subscriptions.

I also looked at Zerotier and fatedier/frp but they all require a local service running.

With Bitvise SSH Client (win) or autossh (linux) i can create multiple reverse SSH tunnels on one machine and (almost) forget about them.