ShellHub enables teams to easily access any Linux device behind firewall and NAT
This is interesting, but how does it work? By leveraging a STUN&#x2F;TURN server? Can we connect on port 22?<p>Actually, there is this link in the subtitle (and in the readme, but only mentions &quot;getting started&quot;, now &quot;how does this work&quot;): <a href="https:&#x2F;&#x2F;shellhub-io.github.io&#x2F;" rel="nofollow">https:&#x2F;&#x2F;shellhub-io.github.io&#x2F;</a> this should probably be the story link.<p>So, short answer to my question (though I had to read <a href="https:&#x2F;&#x2F;github.com&#x2F;shellhub-io&#x2F;shellhub&#x2F;commit&#x2F;fb0ebf10b12700e56ab470634d3c150cd3f34036" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;shellhub-io&#x2F;shellhub&#x2F;commit&#x2F;fb0ebf10b1270...</a> to understand it, the website wasn&#x27;t enough):<p>* You host a TURN-like server somewhere<p>* You locally host an ssh server (see the above commit: using docker)<p>* When you ssh to the local server, the TURN server is contacted, and performs the handshake; your local server proxies to the remote one on the right port<p>This is an interesting proof-of-concept, but:<p>* I wish people would deploy ipv6 without (or with minimal) firewalls instead<p>* As with all TURN, doesn&#x27;t work with symmetrical NATs<p>* This is a bit overkill. If I could ssh into the TURN server and have it reply with the right ssh command, it would work as well (need to be quick)<p>Given the above, this could be built into ssh: specify a TURN server (or plain ssh host) to negociate a port and have the client &amp; server perform the handover.<p>The way I do NAT traversal usually is to setup a reverse tunnel between the target sshd and another server (initiated by the target host), which I then proxy&#x2F;jump on with `-p`. Obviously this uses some of the server&#x27;s bandwidth, hence my proposed offer to add something like TURN negotiation on the server. The intermediate server doesn&#x27;t even need to be aware of this, if you can execute arbitrary commands.<p>I wish more applications were compatible with something like this. The Internet really is broken if we have to jump trough these hoops to get any p2p going. There might be a way to do it in a way that&#x27;s transparent to the application, but we might need a new TCP for this. I wonder if Yggdrasil or GNUnet offer to solve that kind of issues over the current TCP network (making a VPN of sorts between the computers, but not firewalled&#x2F;NATed).