I’ve always been curious on ssh port forwarding enough to experiment and learn it to be deadly enough. I currently have two machines that I’d like to test this with, both -L (local) and -R (remote).
I have a C7 host behind a router and a C8 host on the internet that I’ll be testing with.
Our set up is the following:
192.168.2.222:22 (c7 Host) <-> 192.168.2.1:* (router) <-> 159.203.99.198:22 (c8 host)
Local Forwarding
What I’m going to do is forward port 4444 on my c7 machine to connect to the c8 host on port 22 by launching the following on 192.168.2.222:
$ ssh -L 192.168.2.222:4444:159.203.99.198:22 localhost
At this point I can start a SSH session to 192.168.2.222 at port 4444. I’m prompted to log in at 159.203.99.198, and i’m good to go. As long as the command is running I maintain a connection.
To remove the login necessity I added ~/.ssh/id_rsa.pub to ~/.ssh/authorized_keys for passwordless local log in.
Remote Forwarding
Remote forwarding allows world-accessible hosts to provide access to internal hosts. In our previous scenario we forwarded from an intranetwork host to a world host. Now we’re gonna use that intranetwork host and make it so that if we SSH to the world host at port 4444 that we will be ssh-ing to our intranetwork host, bypassing the router.
On 192.168.2.222 I execute the following:
$ ssh -R 4444:localhost:22 159.203.99.198 -ldiffuser
On my world-accessible host I log in with “diffuser”, and the forwarding is set up.
On 159.203.99.198 I can ssh to localhost:4444 and connect as internaluser with ease:
$ ssh localhost -p 4444 -linternaluser
Due to how /etc/ssh/sshd_config has GatewayPorts set up by default I cannot connect with my home computer to my world-accessible host. I would have to restart sshd service after setting GatewayPorts=yes (by default it’s no)