I am designing an embedded Linux device that acts as a gateway for sensor data. In some cases this device will use a back-haul that I don't control (e.g. customer supplied cell or cable modem). I assume this device will be behind some sort of NAT and that network parameters will be assigned via DHCP in most installations.
For typical communications, the device will open up sockets with a REST web service.
I would like to add some secure diagnostic, command, and control capabilities. What I want is for each gateway to be running something like an SSH server. That way I could have a very flexible interface that a human can use on demand to communicate with a misbehaving gateway and troubleshoot or fix what is going wrong. This presents some obvious security issues, but I am more interested in talking about the networking hurdles I need to overcome at this point:
- My customers would need to open a port on their router and forward port that my device, or my device needs to be directly connected to the internet and not behind NAT.
- If my device is behind NAT it will probably need a static IP
- The customer will need a static IP for their network, or we'll need to capture dynamic IP's through our REST interface.
How can I hole punch SSH?
- Can I make each gateway act like an SSH client and open a session with one of our servers, is there some way to transfer or takeover the SSH session?
- Can I tunnel the data using an IP-in-IP connection or similar?