SSH Port Forwarding

ssh-port-forwarding.md

SSH Port Forwarding

Refer to https://help.ubuntu.com/community/SSH/OpenSSH/PortForwarding

Local Port Forwarding

man:

-L [bind_address:]port:remote_socket
-L local_socket:host:hostport
-L local_socket:remote_socket
        Specifies that connections to the given TCP port or Unix socket on the local (client) host are to be forwarded to the given host and port, or
        Unix socket, on the remote side.  This works by allocating a socket to listen to either a TCP port on the local side, optionally bound to the
        specified bind_address, or to a Unix socket.  Whenever a connection is made to the local port or socket, the connection is forwarded over the
        secure channel, and a connection is made to either host port hostport, or the Unix socket remote_socket, from the remote machine.

        Port forwardings can also be specified in the configuration file.  Only the superuser can forward privileged ports.  IPv6 addresses can be
        specified by enclosing the address in square brackets.

        By default, the local port is bound in accordance with the GatewayPorts setting.  However, an explicit bind_address may be used to bind the
        connection to a specific address.  The bind_address of “localhost” indicates that the listening port be bound for local use only, while an
        empty address or ‘*’ indicates that the port should be available from all interfaces.

-N      Do not execute a remote command.  This is useful for just forwarding ports.

Example:

ssh -L 8080:www.ubuntuforums.org:80 -N user@ssh-server

Dynamic Port Forwarding

man:

-D [bind_address:]port
        Specifies a local “dynamic” application-level port forwarding.  This works by allocating a socket to listen to port on the local side,
        optionally bound to the specified bind_address.  Whenever a connection is made to this port, the connection is forwarded over the secure
        channel, and the application protocol is then used to determine where to connect to from the remote machine.  Currently the SOCKS4 and SOCKS5
        protocols are supported, and ssh will act as a SOCKS server.  Only root can forward privileged ports.  Dynamic port forwardings can also be
        specified in the configuration file.

        IPv6 addresses can be specified by enclosing the address in square brackets.  Only the superuser can forward privileged ports.  By default,
        the local port is bound in accordance with the GatewayPorts setting.  However, an explicit bind_address may be used to bind the connection to
        a specific address.  The bind_address of “localhost” indicates that the listening port be bound for local use only, while an empty address or
        ‘*’ indicates that the port should be available from all interfaces.

Example:

ssh -ND 1080 user@ssh-server

Multi-hops SSH Tunnel

Example:

ssh -L 1080:localhost:1080 user1@server1 ssh user2@server2 -ND 1080

-A may help in such case, like

ssh -AL 1080:localhost:1080 user1@server1 ssh user2@server2 -ND 1080

See https://yakking.branchable.com/posts/ssh-A/ for option -A.

See also the followings for alternatives to make a multi-hops ssh tunnel using option -J in newer SSH version

• https://superuser.com/questions/96489/an-ssh-tunnel-via-multiple-hops
• https://wiki.gentoo.org/wiki/SSH_jump_host

Remote Port Forwarding

See https://unix.stackexchange.com/questions/115897/whats-ssh-port-forwarding-and-whats-the-difference-between-ssh-local-and-remot