Create a template service file at /etc/systemd/system/secure-tunnel@.service. The template parameter will correspond to the name
of target host:
[Unit]
Description=Setup a secure tunnel to %I
After=network.target
[Service]
User=$USER
Group=$USER
EnvironmentFile=/etc/default/secure-tunnel@%i
ExecStart=/usr/bin/ssh -nNT -o ServerAliveInterval=60 -o ExitOnForwardFailure=yes -R ${REMOTE_ADDR}:${REMOTE_PORT}:${LOCAL_ADDR}:${LOCAL_PORT} ${TARGET}
# Restart every >2 seconds to avoid StartLimitInterval failure
RestartSec=5s
Restart=on-failure
[Install]
WantedBy=multi-user.targetWe need a configuration file (inside /etc/default) for each target host we will be creating tunnels for. For example, let's assume we want to tunnel to a host named jupiter (probably aliased in /etc/hosts). Create the file at /etc/default/secure-tunnel@example:
TARGET=example.com
LOCAL_ADDR=127.0.0.1
LOCAL_PORT=22
REMOTE_ADDR=127.0.0.1
REMOTE_PORT=2222
Note that for the above to work we need to have allready setup a password-less SSH login to target (e.g. by giving access to a non-protected private key).
ssh-copy-id $USER@example.com
Now we can enable it, so it get's started at boot time:
sudo systemctl enable --now secure-tunnel@example.service
sudo systemctl status secure-tunnel@example.service