ssh -R 2200:localhost:22 auditee0@safetag-audit.org this will allow the auditee to connect to port 2200 from within safetag-audit.org (S) and have traffic forwarded to port 22 on the auditee's machine (C). the auditee on machine on site 1 will run: ssh -R 2210:localhost:22 auditee1@safetag-audit.org Important: make sure that the ports you use don't conflict with ports by other services or auditees, i.e. don't use a port number twice. Once this session is open, the auditor can access the auditee's machine (C). At this point there are a few powerful options: simply ssh from S to C via the tunnel (port defined in the reverse tunnel on the server localhost interface); example: to connect to site 0: ssh clientUser@localhost -p 2200 with site 1 in the previous example, the port would be 2210 (or whatever the auditee used in her command). Create a VPN-like connection to site: create a forward tunnel from A to S that is "piped" into the reverse tunnel: ssh -L 2200:localhost:2200 user@safetag-audit.org now you have a tunnel from your localhost:2200 to safetag-audit.org:2200, which in turn has a tunnel from safetag-audit.org:2200 to the client machine on port 22. once you have that, you can use sshuttle (needs to be installed, it's in most Linux standard repositories) on the auditor's machine (A) to access additional resources in the auditee's network (as long as they are non-ICMP) directly from the Auditor's machine (A). Such resources might include web-based resources (router web interface for example) or remote desktop (to assess windows or mac clients) or accessing file shares on the auditee's network, etc... Page 64 of 240