Let's say you're in the following situation:

• You work from home, got your work laptop with VPN
• Your laptop screen is so tiny and you would love to hack your Linux projects on your home dual monitor setup
• You are not allowed to connect your private computer to the VPN

Here is your way around this tricky situation!

• Connect the VPN on your work laptop while connected to your home WiFi
• Open an SSH tunnel on your work laptop to the company server you'd like to log on to
• Use your home desktop to connect to your laptop AS IF IT WAS THE SERVER you want to connect to!

This all sounds super technical, so let me give you the simple walkthrough!

Setting up SSH tunnels on the VPN machine

I'll assume you want to open two tunnels in parallel:

• SSH: Port 22 (for console access)
• NoMachine: Port 4000 (for remote desktop access - see their cool free software here)

This tutorial assumes that your work laptop is a Windows machine. Do the following:

• Download plink.exe from the PuTTY website. PuTTY is a great Windows SSH client, which is also able to open SSH tunnels (and X11 forwarding, yay!).
• Create a tunnels.bat file in the same directory as plink.exe with the following contents:

@echo Opening Tunnels

plink.exe -ssh <USERNAME_ON_SERVER>@<ADDRESS_OF_SERVER> -N -L <LAPTOP_IP_IN_HOMENETWORK>:<ADDRESS_OF_SERVER>:22 -L <LAPTOP_IP_IN_HOMENETWORK>:<ADDRESS_OF_SERVER>:4000

• Here you replace the variable fields with the following values:
  • USERNAME_ON_SERVER: The username you log on to the target server with when you are connected to the company VPN
  • ADDRESS_OF_SERVER: The IP or hostname of the server you want to connect to
  • LAPTOP_IP_IN_HOMENETWORK: The IP your work laptop has in your private home network
• Run the tunnels.bat file. You will be asked to enter your SSH password for the target server. Once done, you may need to press Return one more time to start the tunnel (plink will tell you).
• Now from your home computer, connect to the LAPTOP_IP_IN_HOMENETWORK address via SSH or NoMachine. You can work with it as if you're connecting to the server inside the VPN.
• The target server will see the incoming connection originating from the Windows machine, and cannot "see" your home network. That's because the SSH tunnel is opened between only the Windows laptop and the server, no other entity is involved.

Now as long as you leave the tunnels.bat window open, the tunnels stay available. When the SSH connection gets closed on the Windows machine for whatever reason, the tunnels will close automatically.

Final Words

Obviously you're opening up parts of the company VPN into a non-certified home network this way. Make sure you know what you're doing, and if in doubt double-check with IT or compliance if what you're doing is alright.

Apart from that, have fun using the setup of your choice!