5 ms·
A Practical Guide to SSH Tunnels: Local and Remote Port Forwarding
- teddyh 4mo agoIt’s amazing what you can learn by reading the manual.
- felooboolooomba 4mo agoIt is, because manuals are often not the best way to learn things. Most software manuals are reference manuals. SSH man page isn't too bad. I learned most of my SSH knowledge from it, but I'm not sure it's the best way to do it.
- matltc 4mo agoFor me, the best way to learn a tool is for a quick example or two showing its utility, then practicing with those, reading the man as needed on specific flags. Google or bot ”how do x" ? Repeat : done Some pages have a nice up-front synopsis of flags, others put them in a wall of text. Browsing the former can supplant Google, /\b-x while paging is helpful for the latter.
- deleted 4mo ago[deleted]
- deterministic 4mo agoIt's amazing how badly written most manuals are.
- teddyh 4mo agoThat’s quitter talk.
- trollbridge 4mo agoWhen I see one of these with obvious AI tells at the top (sentences lacking a subject or verb), I ask myself: Can’t I just open up a harness and prompt “Teach me how to do X?”
- GL26 4mo agoI personally do this, ask claude code to teach me about concepts I don't know about when it codes something, and only then I accept what it suggests to me
- lfx 4mo agoI do this all the time, I have a skill/gem with instructions on how I want to receive info, how to format and so on. Really helps to go fast to get the point.
- Oxodao 4mo agoCould you share it? I'd be interested to get idea to make my own
- lfx 4mo agoIt goes like this: --- As an expert tutorial creator for experienced engineers, you take the input the user request and make interactive tutorial. Default style is technology, tech is mac and linux. Default style is 20mins, but you ask for the timeline. Also do not forget to provide the cost of technologies used. ---
- chasil 4mo agoThe article mentions bastions, but no jumphosting? ssh -J user1@bastion1,user2@bastion2 targetuser@targethost Edit: Jumphosting was introduced in OpenSSH 7.3 2016-08-01. https://www.openssh.org/releasenotes.html https://www.openssh.org/releasenotes.html
- dspillett 4mo agoIt is surprising how many times I see this content (this version might be marked “Published: Jun 19, 2026” but I've definitely seen those exact diagrams before, starting at least a few years ago, and the same content around them in many tutorials before that) without it being updated to mention jump-hosts. Support was added to OpenSSH about a decade ago? Even on a low moving Linux distro like Debian/LTS everyone should have support by now.
- deleted 4mo ago[deleted]
- m348e912 4mo ago>ssh -J user1@bastion1,user2@bastion2 targetuser@targethost Are you using SSH key auth or password authenticating three times when you do this?
- chasil 4mo agoIf you don't have an agent running with an accessible key, then you will get three password prompts, with suggestions for any default keys. The final target is a pre-elliptic curve OpenSSH server, so legacy is enabled. I could probably have removed that for clarity. C:\Users\me\>ssh -J me@bhost1,me@bhost2 -o KexAlgorithms=diffie-hellman-group14-sha1 -o HostKeyAlgorithms=ssh-rsa -o MACs=hmac-sha1 oracle@target Enter passphrase for key 'C:\Users\me/.ssh/id_ed25519': me@host1's password: Enter passphrase for key 'C:\Users\me/.ssh/id_ed25519': me@host2's password: oracle@target's password: Last login: Wed Jun 24 13:29:55 2026 from bhost2 That client is Microsoft's port of OpenSSH.
- saltcured 4mo ago
- riobard 4mo agoThere's a asymmetry here that "-R" works both for reverse static and dynamic (using SOCKS protocol) forwarding, but "-D" is required for dynamic forwarding which "-L" cannot do. Why is that?
- deleted 4mo ago[deleted]
- hylaride 4mo agoIt's historical. Some older flags could be easily extended for dynamic port support and others could not.
- felooboolooomba 4mo agoAs a sysadmin, one of your biggest ROI is learning the ins and outs of SSH.
- deleted 4mo ago[deleted]
- hylaride 4mo agoLearning how SSH port forwarding is great as a pseudo-vpn for everything from GUI-client database access to (in physical infra) access to web-admin tools for appliances. The socks proxy support can also deal with bad web filtering and privacy issues on public wifi networks (though nowadays if you're ssh'ing to a cloud IP, you'll get lots of "bot" restrictions).
- saltcured 4mo agoYeah, I get use out of the SOCKS proxy mode in combination with a "split VPN" at work. I need VPN to get into some internal resources via SSH, but there are lots of external/public/AWS resources I also need to access, and the full VPN adds too much overhead and fragility for those. Using the available split VPN, I can point a browser instance at a localhost SOCKS proxy port to relay over SSH + VPN for other web resources I need to access internally. Unfortunately, Firefox proxy config rules are sort of backwards for my needs. I want to say "only use proxy for these 3 domains" whereas it wants to use the proxy by default and only allow me to bypass specific domains.
- hylaride 4mo agoIn the past, I've used plugins to do just what you ask. FoxyProxy Standard did the trick (it looks like there's now at least another more standard "VPN" version, too). It looks like Firefox does have support for Native PAC files that'll also do the trick: https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Proxy_servers_and_tunneling/Proxy_Auto-Configuration_PAC_file#example_4 https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Pro...
- Sarky 4mo agoFirefox can be used with socks proxies nicely. - Use Multi-Account Containers plugin, where you define which domain should be opened in which container. - Use Container Proxy to configure which socks proxy to use for different containers. Pair that with ssh tunnel that you use as socks proxy and you have nive tunneling solution for browser.
- 4mo ago
- segphault 4mo agoOr you could just install something like Tailscale and never have to think about it again.
- guluarte 4mo agoor tell an llm to do it for you
- buredoranna 4mo agoI'll mention it here, because I learned about it here. "~C" will drop you into the SSH command line, allowing you to, among other things, effect port forwarding -L8080:localhost:443 Learning that "~C" exists, and what you can do with it, has supercharged my use of SSH tunnels, which were already awesome on their own. But for some reason this has been disabled by default in more recent ssh configurations... to ensure its available -o EnableEscapeCommandline=yes or, in your ~/.ssh/config EnableEscapeCommandline yes (edit: formatting)
- telotortium 4mo agoImportant to note that `~` SSH commands work only right after you press Enter - it doesn’t trigger everywhere you press `~`. Also EnableEscapeCommandline fortunately only affects `~C` - the all-important `~.` to kill a hung SSH session still works with it disabled.
- ptaffs 4mo agoso many time i have inadvertently ended a session with a fat fingered ~.
- trentnelson 4mo agoNot ssh related but I regularly suspend my terminal with Ctrl-S by accident, usually when going for Ctrl-C/V. That was a nightmare to triage back in the late 90s when I did it. Thankfully Ctrl-Q (I think it’s Q) “resumes”, so, easy fix if you know what you’ve done.
- coryrc 4mo agoCorrect. - software flow control user
- jojo2354 4mo agoEh, once I started using master sockets, I never went back. Problem with ~C is it's hard to keep track of what you have open.
- matltc 4mo agoVery refreshing to see a utilitarian series such as this. Disappointing that the latest ai drama gets 20x more discussion and visibility on this site
- wbadart 4mo agoI never pass up an opportunity to recommend the Cyber Plumber's Handbook: https://github.com/opsdisk/the_cyber_plumbers_handbook https://github.com/opsdisk/the_cyber_plumbers_handbook Goes over similar content as TFA, in perhaps a little more depth. Indispensable sysadmin knowledge.
- opsdisk 4mo agoAppreciate the mention wbadart!
- susu1111 4mo agoso good, I learn new things.
- ranger_danger 4mo agoNot mentioning the ssh -w option in that book should be a crime.
- JSR_FDED 4mo agoWhoa that’s useful, learnt something new!
- bheadmaster 4mo agoIf you have many different remote devices behind NATs or firewalls, a cool trick to access them all via EC2 server (or such) is to setup Remote Forwarding via UNIX socket on the server side, to devices' port 22. Preferably, UNIX socket filenames should start with a common prefix, so an SSH config can be written that will use ssh+socat in a ProxyCommand to establish the connection. It's amazing how lightweight this method actually is. I have managed to connect hundreds of devices using a single EC2 nano instance.
- ranger_danger 4mo agoDo you have more info on this method? How is the remote forwarding actually done?
- mldbk 4mo ago[dead]
- bheadmaster 4mo agoThere's an old blogpost I wrote at the time I came up with this method [0]. I think it contains most of the technical details. Let me know if anything is confusing, I'll answer it here. [0] https://paskozdilar.github.io/blog/entries/zero_code_ssh_jumphost.html https://paskozdilar.github.io/blog/entries/zero_code_ssh_jum...
- ranger_danger 4mo agoMaybe I'm missing something, but wouldn't the ssh -J option be much easier?
- bheadmaster 4mo agoHow do you use -J to connect to a device that isn't publicly reachable?
- saltcured 4mo agoI think the more modern ProxyJump rule is superior for this. Just let it manage the actual TCP forwarding for you automatically. It's just the normal "bastion host" concept. Particularly, you can use name patterns to apply the same rule broadly, assuming you have some systematic naming scheme for your eventual target devices.
- Bender 4mo agoShould add how to bypass MFA using phishing and SSH Multiplexing to the article.
- smw 4mo agoNeed to mention sshuttle [0] here, as it magically solves a bunch of these problems without constant reconfiguration [0] https://github.com/sshuttle/sshuttle https://github.com/sshuttle/sshuttle
- mystifyingpoi 4mo agosshuttle is amazing. I've used it extensively on stupidly configured networks, super useful tool.
- hansvs 4mo agoYup, use it regularly in order to jump through networks where a VPN/Wireguard setup is not possible. It can also forward DNS requests and handle local NS operations reasonably well, such that it can be used as a low-key split-VPN client (i.e. only forwards traffic for a specific domain or IP range without redirecting any other traffic). Note that for integration with `systemd-resolved`, one needs to jump through a few hoops, but I feel its works very nicely: https://github.com/sshuttle/sshuttle/issues/688#issuecomment-971833099 https://github.com/sshuttle/sshuttle/issues/688#issuecomment....
- ranger_danger 4mo agoAnother option that I never see mentioned anywhere is -w which allows you to create either layer2 or layer3 tunnels via a tun(4) interface.
- tangotaylor 4mo agoMy favorite use of this is peer-to-peer transfer of Docker images. The Docker CLI only allows you to use registries authenticated with HTTPS but there's an exception where it allows HTTP transfers over localhost. So, if you use SSH tunneling to forward a port from localhost to a remote, then Docker unwittingly pushes to a remote. This is super useful "off the grid" with robotics/embedded applications where you don't want to bother with a registry and a good Internet connection. Example, docker pussh: https://github.com/psviderski/unregistry https://github.com/psviderski/unregistry
- Kampfschnitzel 4mo agoiirc there's a setting to allow docker to trust and use http registries i set it up a few years ago for my homelab
- afiori 4mo agoWhich makes me think that I have never heard of signed images/artefacts
- QGQBGdeZREunxLe 4mo agoThis is really useful as you don't have to add an entry under insecure-registries for local registries that don't have valid certificates.
- bitlad 4mo agoYou might as well handover the images to hackers.
- QGQBGdeZREunxLe 4mo agoA tad hyperbolic for a LAN registry
- janmatejka 4mo ago
- phbeks 4mo agoThanks! I will keep this for reference. I use ssh alot but thie reminds me that I can learn new ways of tunneling :-)
- ktm5j 4mo agoWeird.. I have almost this exact same "cheat sheet" printed out and stuck up on my whiteboard.. except it's slightly different. Only 4 panels instead of 6 and the panels don't have titles. I know this is a solid "cool story bro" moment, but whatever hah
- chb 4mo agoReminiscent of Steve Friedl's excellent work: http://www.unixwiz.net/techtips/ssh-agent-forwarding.html http://www.unixwiz.net/techtips/ssh-agent-forwarding.html
- nekusar 4mo agoBTW I use this and a systemd unit file and SSH tunnel my Jellyfin to a public VPS to its local host. I then use nginx to proxy it. Because its a unit file, sshd reconnects if my ISP's IP changes. Does so within 30s. Also hides my ISP IP in case I have to turn it off. And no data is effectively on the VPS. Its just a mostly empty machine.
- ggm 4mo agoAlways annoys me -p(port) for ssh clashes with -p(reserve permissions) for sftp and scp. Unavoidable given history. Also annoys me we "invented" ssh:// url format after the tools were baked so it's a somewhat odd bonding into the model.
- pss314 4mo agoHak5 video that helped me understand many years ago about the practical usage of SSH forwarding Hak5 - SSH Forwarding: Local vs Remote with examples, Hak5 1113 part1 https://www.youtube.com/watch?v=g_Row8zEJZc https://www.youtube.com/watch?v=g_Row8zEJZc
- saidinesh5 4mo agoThe best part of this is you can daisy chain tunnels and have a network connection between any machines you can ssh into. If you have a private server with a public IP, you don't need localtunnel etc.. you can just use ssh tunnels to expose your home network services over public IP.
- ale42 4mo agoI think that the start of the article is at least a bit exaggerated: SSH is yet another example of an ancient technology that is still in wide use today. Ancient technology? If it was telnet or FTP... But SSH is much younger than, let's say, IPv4, which is _maybe_ ancient technology still in wide use today.