SSH Tunneling Mode for NetGear API¶

Overview¶

SSH Tunneling Mode allows you to connect NetGear client and server via secure SSH connection over the untrusted network and access its intranet services across firewalls. This mode works with pyzmq's zmq.ssh module for tunneling ZeroMQ connections over ssh.

This mode implements SSH Remote Port Forwarding which enables accessing Host(client) machine outside the network by exposing port to the public Internet. Thereby, once you have established the tunnel, connections to local machine will actually be connections to remote machine as seen from the server.

All patterns are valid for this mode and it can be easily activated in NetGear API at server end through ssh_tunnel_mode string attribute of its options dictionary parameter during initialization.

Prerequisites¶

SSH Tunnel Mode requires pexpect or paramiko as an additional dependency which is not part of standard VidGear package. It can be easily installed via pypi as follows:

# install paramiko
pip install paramiko

# install pexpect
pip install pexpect

Exclusive Attributes¶

For implementing SSH Tunneling Mode, NetGear API currently provide following exclusive attribute for its options dictionary parameter:

• ssh_tunnel_mode (string) : This attribute activates SSH Tunneling Mode and assigns the "<ssh-username>@<client-public-ip-address>:<tcp-forwarded-port>" SSH URL for tunneling at Server end. Its usage is as follows:

  On Server end, NetGear automatically validates if the port is open at specified Client's Public IP Address or not, and if it fails (i.e. port is closed), NetGear will throw AssertionError!

  With Default PortWith Custom Port

  The default port value in SSH URL is 22, meaning Server assumes TCP Port 22 is forwarded on Client's end by default.

  # activate SSH Tunneling and assign SSH URL
  options = {"ssh_tunnel_mode":"userid@52.194.1.73"}
  
  # i.e. only connections from the Public IP address `52.194.1.73` 
  # on default port 22 are allowed.
  

  But, you can also define your own custom TCP forwarded port instead:

  Here we're defining our own TCP Port 8080, meaning Server assumes TCP Port 8080 is forwarded on Client's end.

  # activate SSH Tunneling and assign SSH URL
  options = {"ssh_tunnel_mode":"userid@52.194.1.73:8080"}
  
  # i.e. only connections from the Public IP address `52.194.1.73` 
  # on custom port 8080 are allowed.
  

• ssh_tunnel_pwd (string): This attribute sets the password required to authorize Host(client) for SSH Connection at Server end. This password grant access and controls SSH user can access what. It can be used as follows:

  # set password for our SSH conection
  options = {
      "ssh_tunnel_mode":"userid@52.194.1.73",
      "ssh_tunnel_pwd":"mypasswordstring",
  } 
  

• ssh_tunnel_keyfile (string): This attribute sets path to Host key that provide another way to authenticate Host(client) for SSH Connection at Server end. Its purpose is to prevent man-in-the-middle attacks. It allows device authentication keys to be rotated and managed conveniently and every connection to be secured. It can be used as follows:

  You can use Ssh-keygen tool for creating new authentication key pairs for SSH Tunneling.

  # set keyfile path for our SSH conection
  options = {
      "ssh_tunnel_mode":"userid@52.194.1.73",
      "ssh_tunnel_keyfile":"/home/foo/.ssh/id_rsa",
  } 
  

Usage Example¶

Client's End¶

Open a terminal on Client System (A Regular PC where you want to display the input frames received from the Server) and execute the following python code:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38

# import required libraries
from vidgear.gears import NetGear
import cv2

# Define NetGear Client at given IP address and define parameters 
client = NetGear(
    address="127.0.0.1", # don't change this
    port="5454",
    pattern=2,
    receive_mode=True,
    logging=True,
)

# loop over
while True:

    # receive frames from network
    frame = client.recv()

    # check for received frame if Nonetype
    if frame is None:
        break

    # {do something with the frame here}

    # Show output window
    cv2.imshow("Output Frame", frame)

    # check for 'q' key if pressed
    key = cv2.waitKey(1) & 0xFF
    if key == ord("q"):
        break

# close output window
cv2.destroyAllWindows()

# safely close client
client.close()

Server's End¶

Now, Open the terminal on Remote Server System (A Raspberry Pi with a webcam connected to it at index 0), and execute the following python code:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47

# import required libraries
from vidgear.gears import VideoGear
from vidgear.gears import NetGear

# activate SSH tunneling with SSH URL, and
# [BEWARE!!!] Change SSH URL and SSH password with yours for this example !!!
options = {
    "ssh_tunnel_mode": "test@52.155.1.89", # defaults to port 22
    "ssh_tunnel_pwd": "pas$wd",
}

# Open live video stream on webcam at first index(i.e. 0) device
stream = VideoGear(source=0).start()

# Define NetGear server at given IP address and define parameters
server = NetGear(
    address="127.0.0.1", # don't change this
    port="5454",
    pattern=2, 
    logging=True, 
    **options
)

# loop over until KeyBoard Interrupted
while True:

    try:
        # read frames from stream
        frame = stream.read()

        # check for frame if Nonetype
        if frame is None:
            break

        # {do something with the frame here}

        # send frame to server
        server.send(frame)

    except KeyboardInterrupt:
        break

# safely close video stream
stream.stop()

# safely close server
server.close()