What is SSH tunneling and reverse port forwarding?
What is SSH tunneling and reverse port forwarding?
Introduction
SSH tunnel consists of an encrypted tunnel which is created through a SSH protocol. This tunnel can be used to transfer unencrypted traffic through an encrypted channel over the network. For example we can use a SSH tunnel to securely transfer files.
SSH tunnels are also used for bypassing firewalls that deny certain internet services.
Port Forwarding
SSH tunnels can be created in various ways depending on which type of port forwarding is used:
There are three types of port forwarding:
- Local port forwarding
- Remote port forwarding
- Dynamic port forwarding
Tunnelling with Local port forwarding
Lets say, yahoo.com is being blocked using a proxy filter at your college. An SSH tunnel can be used to bypass this restriction. Let’s give name to my machine at college as “college-pc” and my home machine as “home-pc” (SSH server should be running on “home-pc”)
To create the SSH tunnel that is executed from “college-pc” use the below command:
ssh -L 9090:facebook.com:80 <user>@home-pc
-L indicates that this is local port forwarding
Now SSH client at college-pc is connected to SSH server running at “home-pc”. This is also binding port 9090 of college-pc to listen to all local requests thus creating an SSH tunnel between “college-pc” and “home-pc”.
At the home-pc side, It will create a connection to yahoo.com at port 80. home-pc will think of how to connect to yahoo rather than college-pc.
Now we can browse yahoo.com at work using localhost:9090
The home-pc will act as a gateway.
Reverse Tunnelling with remote port forwarding
Let’s say you want to connect to an internal university website from the home-pc system.
The university firewall will block its incoming traffic. We have to use SSH reverse tunnelling here.
ssh -R 9090:intra-site.com:80 <user>@home-pc (Executed from college-pc)
We will use the option -R for reverse tunneling.
Once done, The SSH client at college-pc will connect to the SSH server running at home-pc. Then the server will bind port 9090 on home-pc to listen to all incoming requests.
By visiting localhost:9090 at home-pc, the college-pc will create a connection to the internal site and give back the response to home-pc via the created SSH channel.
