Systemd configuration for persistent ssh reverse tunnel

ssh.remote.service

[Unit]
Description=SSH tunnel service SSH on local port 22 to 22000 on remote host
Wants=network-online.target
After=network-online.target
StartLimitIntervalSec=0

[Service]
User=tunnel
Group=tunnel
Type=simple
Restart=always
RestartSec=60
ExecStart=/usr/bin/ssh -o UserKnownHostsFile=/home/tunnel/.ssh/known_hosts -o ExitOnForwardFailure=yes -o "ServerAliveInterval 30" -o "ServerAliveCountMax 3" -NTR 22000:localhost:22 tunnel@example.com -i /home/tunnel/.ssh/id_rsa

[Install]
WantedBy=multi-user.target

The remote address can be bound publicly using the bind: -R *:22000:localhost:22, but this increases attack surface.

Instead, one can use an SSH config (.ssh/config) to bounce off localhost on the remote:

Host dm-iarc-01
    Hostname localhost
    Port 22000
    User change_me

    # Connect via remote host
    ProxyCommand ssh change_me@example.com nc -w 5 $(echo %h|cut -d%% -f1) %p