被控制端没有NAT或者没有静态公网IP，把本端一台服务器映射到外网给远端SSH进来，建立SSH反向隧道。
先映射本端机器到外网
nat server 2222to22 protocol TCP global 1.2.4.8 22 inside 10.10.10.10 22 no-reverse
?
被控端发起连接
ssh -fCNR 8822:localhost:22 root@1.2.4.8 -p 2222
?
# -f Requests ssh to go to background just before command execution
# -C Requests compression of all data
# -N Do not execute a remote command
# -R [bind_address:]对端port:host:hostport
#Specifies that the given port on the remote (server) host is to be forwarded to the given host and port on the local side.
本端检查连接
ss -tunl |grep 8822
# 连接被控端发起ssh连接监听的8822端口，转到被控端的22端口
ssh root@127.0.0.1 -p 8822
?
原文：https://www.cnblogs.com/fatt/p/10619357.html