SSH Tunneling
Let’s keep it simple. The commands below show how to set up SSH tunnels for different situations, whether you need to bring a remote port onto your local machine (-L), make a local port accessible on a remote machine (-R), or set up a SOCKS proxy (-D).
Local Port Forwarding (Option: -L)
When you use local port forwarding, you’re effectively taking a port on your local computer and plugging it into a port on the remote server. This lets you pretend that a remote service is actually running on your own machine.
| Scenario | Command | Explanation |
|---|---|---|
| Forward a remote website to your local port 8888 | ssh -L 8888:localhost:80 [email protected] | After you run this, if you go to http://localhost:8888 in your browser, you’ll see the remote server’s web page that’s actually on port 80. |
| Access a remote database (PostgreSQL on port 5432) | ssh -L 5432:localhost:5432 [email protected] | Point your local database client at localhost:5432, and it talks securely to the remote database. |
| Forward multiple ports in one go | ssh -L 8080:localhost:80 -L 8443:localhost:443 [email protected] | This way, you can forward two services (like HTTP and HTTPS) at once. |
| Run in the background | ssh -fN -L 8000:localhost:80 [email protected] | Add -fN if you just want the tunnel and don’t need an interactive shell. SSH will hang out silently in the background. |
Remote Port Forwarding (Option: -R)
Remote port forwarding does the opposite: it lets you open a port on the remote server that points back to something running on your local machine.
| Scenario | Command | Explanation |
|---|---|---|
| Expose your local web server to the remote machine | ssh -R 8080:localhost:3000 [email protected] | If your local website runs on localhost:3000, then people on server.example.com can access it via localhost:8080 on that remote box. |
| Allow remote SSH access back to your local machine | ssh -R 2222:localhost:22 [email protected] | After connecting, you (or someone on the remote machine) can do ssh localhost -p 2222 and get into your local system. |
| Make the remote port publicly reachable | 1. On the remote server, enable GatewayPorts yes in /etc/ssh/sshd_config. |
ssh -R 8080:localhost:3000 [email protected]| IfGatewayPortsis on, your service is accessible to anyone who can reach the remote server’s IP on port 8080. Be careful with this—it can open your local machine to the internet. |
Dynamic Port Forwarding (Option: -D)
Dynamic forwarding sets up a SOCKS proxy on your local computer. Any application that supports SOCKS can use this to route traffic through the SSH server.
| Scenario | Command | Explanation |
|---|---|---|
| Create a SOCKS proxy on local port 1080 | ssh -D 1080 [email protected] | Configure your browser to use localhost:1080 as a SOCKS5 proxy, and you’re browsing through the remote server. Great for security when you’re on untrusted Wi-Fi. |
| Run that proxy in the background | ssh -fN -D 1080 [email protected] | Same effect, but you don’t see a shell session. |
| Add compression | ssh -C -D 1080 [email protected] | -C might help if you’re on a slow connection, though it depends on the type of data you’re sending. |
