SSH Tunneling

ssh-tunneling.jpg

About

SSH tunneling is a method of transporting arbitrary networking data over an encrypted SSH connection. It can be used for secure communications or to bypass firewalls.

Mode of Port Forwarding

• Local Port Forwarding
• Remote Port Forwarding
• Dynamic Port Forwarding

SSH Useful Arguments

Sample Scenarios

Note: All diagrams from Ivan Velichko

1. Local Port Forwarding:

   This is the most common type of SSH tunneling, forwarding a local port to a remote one.

ssh -L local_port:remote_host:remote_port user@ssh_server

Example01:

local-port-forwarding-bastion-2000-opt.png

ssh -N -L 8443:10.2.2.254:8006 [email protected]

Note: 0.0.0.0:8443:10.2.2.254:8006, which 0.0.0.0 means listening on all available network interfaces.

2023-07-19_103836.png

The service running on port 8443 can be accessed from the server area server by localhost.

Example02:

local-port-forwarding-2000-opt.png

ssh -N -L 5201:localhost:5201 user@ssh_server

2023-07-19_105519.png

A port `5201' test was successfully conducted on localhost after binding the port.

1. Remote Port Forwarding:

   This allows you to forward a remote port to a local one.

For security reasons, Remote Port Forwarding is only bound to the localhost of the SSH Server by default. To enable external connections, the configuration file of the SSH Server needs to be amended

sudo sh -c 'echo "GatewayPorts yes" >> /etc/ssh/sshd_config.d/GatewayPorts.conf'

sudo service sshd restart

Restart the SSH daemon for the modifications to take effect.

remote-port-forwarding-2000-opt.png

ssh -N -R remote_port:local_host:local_port user@ssh_server

Example01:

ssh -N -R 8080:localhost:8000 [email protected]

2023-07-19_113526.png

A simple HTTP server has been set up on localhost with port 8000.

2023-07-19_113559.png

The remote client (10.2.2.x) can access the HTTP server running on port 8080.

remote-port-forwarding-home-network-2000-opt.png

Example02:

ssh -N -R 8443:10.10.10.254:443 user@ssh_server

2023-07-19_112905.png

The SSH server is forwarding traffic from port 443 on the local area PC with IP address 10.10.10.254 to port 8443 on the SSH server.

2023-07-19_112918.png

The service on port 8443 can be accessed from the server area PC.

1. Dynamic Port Forwarding:

   This can be used to create a SOCKS proxy which can be used with applications configured to use SOCKS.

ssh -D local_port user@ssh_server

Example01:

ssh -N -D 8244 user@ssh_server

i. The method of routing browser traffic through a SOCKS5 proxy using a plug-in(SwitchyOmega).

2023-07-18_133142.png

2023-07-18_133219.png

ii. The method of Linux terminal traffic through socks5 proxy

export http_proxy=socks5://127.0.0.1:8244 
export https_proxy=socks5://127.0.0.1:8244

This tells applications that use the HTTP(s) protocol to use the specified SOCKS5 proxy server for their connections.

export ALL_PROXY=socks5://127.0.0.1:8244

This tells all applications to use the specified SOCKS5 proxy server for their connections, regardless of the protocol.

Conclusion

SSH tunneling provides a powerful and flexible way to securely transfer data over an unsecured network. By using SSH tunneling, we can access remote resources securely and efficiently, without having to worry about eavesdropping or other security threats.

Reference

-A Visual Guide to SSH Tunnels: Local and Remote Port Forwarding
-SSH Tunnel 通道打造加密 Proxy，透過外部 Linux 伺服器上網
-SSH Tunneling (Port Forwarding) 詳解