SSH Tunneling

The Golden Rule of SSH Tunneling

Where is the entry point of the tunnel?

• -L (Local): The entry point is on your Local machine. (You want to grab something out there and bring it here).
• -R (Remote): The entry point is on the Remote server. (You want to take something here and show it to people there).

1. Local Port Forwarding (-L)

• The Vibe: "I want to access a database/service that is blocked or inside a private network, using my local machine."

When you use -L, you tell your local computer to open a port. Anything you send to that local port gets tunneled through SSH and delivered to a target destination on the other side.

The Syntax:

Bash

ssh -L [my_machine_port]:[target_ip]:[target_port] user@ssh_server

Real-World Example:

You want to connect to a PostgreSQL database (port 5432) running on a private database server (10.0.0.5). You can't access it directly, but you can SSH into a jump box (jumpbox.com) that has access to it.

Bash

ssh -L 9000:10.0.0.5:5432 user@jumpbox.com

• What happens: You open port 9000 on your laptop. If you point your database GUI to localhost:9000, the traffic tunnels through the jumpbox and hits the database at 10.0.0.5:5432.

2. Remote Port Forwarding (-R)

• The Vibe: "I am developing a website on my laptop, and I want someone on the internet to see it via a public server."

With -R, you tell the remote SSH server to open a port. Anyone who connects to that port on the remote server gets tunneled backward through your SSH connection directly to your laptop (or another machine you point to).

The Syntax:

Bash

ssh -R [remote_server_port]:[my_target_ip]:[my_target_port] user@public_server

Real-World Example:

You are running a web app locally on your laptop (localhost:3000). You want your client to test it. You SSH into your public server (my-public-website.com).

Bash

ssh -R 8080:localhost:3000 user@my-public-website.com

• What happens: Your public server opens port 8080. When someone visits my-public-website.com:8080, the traffic is safely tunneled back to your laptop’s port 3000.

3. Dynamic Port Forwarding (-D)

• The Vibe: "I am on sketchy coffee shop Wi-Fi and want to browse the web securely, or bypass a firewall."

Instead of mapping one specific port to another specific port, -D turns the SSH server into a SOCKS proxy. Your browser (or any app) sends all its traffic through this port, and the SSH server fetches the websites for you.

The Syntax:

Bash

ssh -D 1080 user@secure_server

• What happens: You set up your browser's proxy settings to use SOCKS host: localhost and Port: 1080. Now, your browser acts as if it is physically located where the secure_server is.

Quick Cheat Sheet to Save in Your Notes