From 714d4dc2ee13268680f3ac3e43093a758f39eaf6 Mon Sep 17 00:00:00 2001 From: Artur Boryś Date: Fri, 9 Jul 2021 17:19:57 +0200 Subject: [sshadvanced] ssh tunneling section --- sshadvanced.html | 41 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 41 insertions(+) diff --git a/sshadvanced.html b/sshadvanced.html index 33d9cb0..de5bd9a 100644 --- a/sshadvanced.html +++ b/sshadvanced.html @@ -109,6 +109,47 @@ Host * 
ssh -F /dev/null username@hostname

There's more to ssh config files, but I direct you to man ssh_config for more information

+

SSH Tunneling ("port forwarding")

+

+ SSH tunneling gives you the ability to route TCP traffic from your location to the remote server or the other way around (if server allows for this). + Thanks to it, you can set up a secure connection with a service that doesn't provide any encryption by default. You can treat it like a lite VPN. +

+

+ You can for example access your SQL server via SSH without opening the port for public - you just need SSH port opened on the server's firewall. + It's also a great way of creating a secure channel for connecting with other hosts on the server's network. +

+

Local to remote

+

+ You can route traffic from your local network to the remote server's network by using the -L option. + Let's say you want to access a MySQL service on the remote server. You can tell SSH to route any + traffic that comes to your 3000 port to port 3306 on the remote server with the following example: + 

ssh -L 3000:localhost:3306 username@example.com
+

+

+ The above command states that anyone connecting to your port 3000 will be routed via the SSH connection to the localhost:3306 from the remote server's perspective +

+

+ If you can't understand the above description, let's take a look at another example: + 

ssh -L localhost:8080:192.168.178.25:80 username@example.com
+

+

+ The above command states that any traffic comming from your device (and only your's, because of localhost) will be routed via the + SSH channel to 192.168.178.25:80 in the server's network. +

+

+ In general, the argument's structure is as follows: + 

-L [local_address:][local_port]:[remote_address]:[remote_port]
+

+

+ The local_address can be your LAN IP, localhost or any other address that your device has. Depending on it, other devices in + the specified network will be able to connect to you or not. +

+

+ The remote_address can be any address reachable from the server. +

+

You can, of course, route multiple ports. For example: + 

ssh -L 8000:localhost:8000 -L 8001:localhost:8001 username@example.com
+