SSH magics

SSH tunneling (also known as SSH port forwarding) is powerful technique that allows system administrators to create secure encrypted connections between servers, bypass firewalls, and access services securely across networks. Its also known as SSH magics! Whether you’re trying to securely access internal services, create SOCKS proxies, or establish reverse tunnels to overcome network restrictions, SSH tunnels provide flexible solutions for modern networking challenges. This comprehensive guide explores essential SSH tunneling commands that every system administrator should know, complete with practical examples and use cases to enhance your network security toolkit. So let’s get on with some SSH magics, shall we?

BTW, if case you want me here’s Top 30 SSH shenanigans

What is SSH Tunneling?

SSH tunneling creates an encrypted pathway through which data can travel between systems. It works by encapsulating another protocol within the SSH protocol, allowing you to bypass firewalls, secure otherwise insecure connections, or access services on remote networks as if they were local. There are three primary types of SSH tunnels:

1. Local Port Forwarding: Forwards connections from a local port to a remote server
2. Remote Port Forwarding: Forwards connections from a remote server back to your local machine
3. Dynamic Port Forwarding: Creates a SOCKS proxy server for flexible routing

Essential SSH Tunneling Commands

Establishing a Reverse SSH Tunnel

ssh -R 2001:localhost:22 [username]@[remote server ip]

This command creates a reverse tunnel that allows connections to port 2001 on the remote server to be forwarded to port 22 on your local machine. This is particularly useful when you need to:

• Access machines behind firewalls
• Create backdoor access to your local machine for troubleshooting
• Allow remote users to SSH into your local computer despite NAT or firewall restrictions

On the remote server, connecting to port 2001 will forward all encapsulated packets to port 22 on your local machine, effectively establishing SSH access to your local system through an outbound connection.

Creating a SOCKS Proxy with SSH

ssh -D 8888 [email protected]

This straightforward command establishes a SOCKS proxy server on your local port 8888. Once connected, you can configure your web browser or applications to use this SOCKS proxy, enabling you to:

• Browse websites through an encrypted tunnel
• Bypass network restrictions or geolocation blocks
• Hide your browsing activities from local network monitoring
• Access resources only available to the remote server

Simply update your browser’s proxy settings to point to “localhost” with port “8888” as a SOCKS proxy, and your traffic will be routed through the SSH tunnel.

Setting Up a Basic SSH Tunnel

ssh -f -N -L 4321:home.network.com:25 [email protected]

This command sets up an SSH tunnel for another connection, leveraging several useful flags:

• -f: Runs SSH in the background
• -N: Indicates there’s no command to run on the remote server
• -L: Handles the local port forwarding

In this example, connections to your local port 4321 will be forwarded to port 25 on home.network.com. This technique is commonly used for:

• Securely accessing email servers
• Encrypting connections to services that don’t offer encryption
• Bypassing network restrictions on specific ports

One-Time VNC Over SSH Connection

ssh -f -L 5900:localhost:5900 your.ssh.server "x11vnc -safer -localhost -nopw -once -display :0"; vinagre localhost:5900

This comprehensive command creates a secure, single-use VNC connection through an SSH tunnel by:

1. Establishing an SSH connection to your server
2. Tunneling the VNC port (5900) to your local machine
3. Running a one-time VNC server on the remote machine
4. Moving the SSH process to the background
5. Launching a VNC viewer (vinagre) to connect through the tunnel

This approach provides a secure way to access graphical desktops remotely without exposing the VNC port directly to the internet.

RDP Through SSH Tunnel

ssh -f -L3389:192.168.1.100:3389 [email protected] "sleep 10" && rdesktop -T'Remote Desktop' -uAdministrator -g800x600 -a8 -rsound:off -rclipboard:PRIMARYCLIPBOARD -5 localhost

This powerful command combines SSH tunneling with RDP (Remote Desktop Protocol) to:

1. Create an SSH tunnel to a jump host
2. Forward local port 3389 to a target Windows machine (192.168.1.100)
3. Wait 10 seconds for the connection to establish
4. Launch an RDP client connected to the tunnel

This provides encrypted access to Windows Remote Desktop services even when direct RDP access would be insecure or blocked by firewalls.

Self-Healing SSH SOCKS Proxy with AutoSSH

autossh -f -M 20000 -D 8000 somehost -N

This advanced command uses AutoSSH to create a resilient SOCKS proxy that automatically reconnects if the connection breaks:

• -M 20000: Uses ports 20000 and 20001 for connection monitoring
• -D 8000: Creates a SOCKS proxy on local port 8000
• -N: No remote command execution
• -f: Runs in background

This setup is perfect for maintaining persistent secure tunnels in environments with unreliable connections.

Simple Port Forwarding

ssh -NL 2000:remotehost:22 remotehost

This minimalist command forwards connections from your local port 2000 to port 22 on the remote host. The -N flag specifies no command execution on the remote server, making this purely a tunneling session.

Best Practices for SSH Tunneling

When implementing SSH tunnels, consider these security best practices:

1. Use Key-Based Authentication: Avoid password authentication when possible
2. Restrict Forwarded Ports: Bind to localhost (127.0.0.1) when possible to prevent external access
3. Consider Connection Timeouts: Implement keepalive settings for long-running tunnels
4. Monitor Open Tunnels: Regularly audit active SSH connections and tunnels
5. Use Jump Hosts: Implement bastion hosts for accessing sensitive internal networks

Conclusion

SSH tunneling commands provide system administrators with powerful tools for secure remote access, bypassing network restrictions, and encrypting connections to services that may not offer built-in encryption. By mastering these essential SSH tunnel commands, you can enhance your network security posture while maintaining flexible access to the resources you need. Whether you’re creating reverse tunnels through firewalls, establishing SOCKS proxies for secure browsing, or setting up one-time VNC connections, SSH tunneling offers versatile solutions for modern networking challenges. Start implementing these commands in your environment to leverage the full security potential of SSH tunneling.