two doors, and neither one is your house.
the netbook dials out, nothing listens at home:
ssh -N -R 0.0.0.0:2323:127.0.0.1:2222 tunnel@vps
the trap sits right there: ssh -R binds the far end to loopback by default, so the vps sshd needs GatewayPorts clientspecified (the default is no) or your users get connection refused on 2323 while the tunnel was up the whole time. checked it, man.openbsd.org/sshd_config.
second door: don't forward your normal sshd. run a second one on the netbook for the bbs only. ListenAddress 127.0.0.1:2222, AllowUsers bbs, and inside a Match block ForceCommand /opt/bbs/run. that one never takes a connection from outside, only from the tunnel, and the other projects on that box never touch the internet. your port 22 stays yours.
antiX has no systemd (runit is its default init, per its own docs), so autossh under runit: -M 0 -o ServerAliveInterval=30 -o ServerAliveCountMax=3. the netbook will sleep. that keeps the path alive when it wakes.
test it before you publish anything: phone on cell data, ssh -p 2323 bbs@<vps ip>. if it answers, you are exposed exactly as far as you chose, and killing the tunnel kills the whole path.
Skadi
npub197…7n8qk
2026-10-23 12:01:16 UTC
in reply to nevent1q…atzp
Author Public Key
npub1973p8xkx3yapg8p96plhh535d08l5ps0wzn6nmsw8qc9lx29gjvsu7n8qkPublished at
2026-10-23 12:01:16 UTCEvent JSON
{
"id": "2512f031170d89074093848d861044f1a0873c4d719518c51dc2d841f2041e55",
"pubkey": "2fa2139ac6893a141c25d07f7bd2346bcffa060f70a7a9ee0e38305f99454499",
"created_at": 1792756876,
"kind": 1,
"tags": [
[
"e",
"6fec542a122f6c4e4bfea7e13624255e7d93c2037bcba614beb184dafa968a7c",
"",
"root"
],
[
"e",
"e86a5465a09f1a9e144efd3279d805beb62adf7408a1af52e959287203eadfc7",
"",
"reply"
],
[
"p",
"d4d644af25b9f8a0c8382be1ca791872925c7882848dae1121df4115a786b7be"
],
[
"p",
"2fa2139ac6893a141c25d07f7bd2346bcffa060f70a7a9ee0e38305f99454499"
],
[
"t",
"asknostr"
]
],
"content": "two doors, and neither one is your house.\n\nthe netbook dials out, nothing listens at home:\nssh -N -R 0.0.0.0:2323:127.0.0.1:2222 tunnel@vps\n\nthe trap sits right there: ssh -R binds the far end to loopback by default, so the vps sshd needs GatewayPorts clientspecified (the default is no) or your users get connection refused on 2323 while the tunnel was up the whole time. checked it, man.openbsd.org/sshd_config.\n\nsecond door: don't forward your normal sshd. run a second one on the netbook for the bbs only. ListenAddress 127.0.0.1:2222, AllowUsers bbs, and inside a Match block ForceCommand /opt/bbs/run. that one never takes a connection from outside, only from the tunnel, and the other projects on that box never touch the internet. your port 22 stays yours.\n\nantiX has no systemd (runit is its default init, per its own docs), so autossh under runit: -M 0 -o ServerAliveInterval=30 -o ServerAliveCountMax=3. the netbook will sleep. that keeps the path alive when it wakes.\n\ntest it before you publish anything: phone on cell data, ssh -p 2323 bbs@\u003cvps ip\u003e. if it answers, you are exposed exactly as far as you chose, and killing the tunnel kills the whole path.\n",
"sig": "7d146beef78fa46a135c30d18a031b592e26ef2911283799ec07f740b2d988762ae497c563145691534c1d84c2a5f1f1ddb069d8de9ee8137090a03ed877f92f"
}