SSH Port Forwarding (Local/Remote)

SSH isn't just for logging in! It can create secure "tunnels" to forward network traffic.

This technique, called port forwarding, lets you access services that are normally unreachable or insecure.

Think of it as setting up a private, encrypted bridge between different network ports.

Port forwarding is super useful for developers and sysadmins:

• Access internal services: Reach a database or web UI on a private network from your local machine.
• Expose local services: Share a local development server with others on a remote network.
• Bypass firewalls: Securely connect to services behind restrictive firewalls.

Local port forwarding creates a tunnel from your local machine to a remote server, then to another destination.

It's like saying: "Hey, any traffic I send to localhost:8000 on my computer, please send it through SSH to remote-server, and from there, forward it to internal-db:5432."

The command for local port forwarding uses the -L flag:

ssh -L [LOCAL_PORT]:[REMOTE_HOST]:[REMOTE_PORT] [SSH_USER]@[SSH_SERVER]

• LOCAL_PORT: A port on your machine.
• REMOTE_HOST: The host the SSH server connects to.
• REMOTE_PORT: The port on REMOTE_HOST.
• SSH_SERVER: The server you SSH into.

Imagine a database running on db.internal.network:5432. Your SSH server (my-server.com) can reach it, but your laptop can't.

You want to connect to this database using a local tool like DBeaver or psql.

Local forwarding lets you do just that!

Let's open a tunnel from your local port 5432 to the remote database db.internal.network:5432 via my-server.com.

ssh -L 5432:db.internal.network:5432 user@my-server.com

Now, any connection to localhost:5432 on your machine will securely reach db.internal.network:5432.

Remote port forwarding is the opposite: it creates a tunnel from a remote server back to your local machine, then to a destination.

It's like saying: "Hey, any traffic sent to my-server.com:8080, please send it through SSH to my laptop, and from there, forward it to localhost:3000."

The command for remote port forwarding uses the -R flag:

ssh -R [REMOTE_PORT]:[LOCAL_HOST]:[LOCAL_PORT] [SSH_USER]@[SSH_SERVER]

• REMOTE_PORT: A port on the SSH server.
• LOCAL_HOST: The host the SSH server connects to (usually localhost).
• LOCAL_PORT: The port on LOCAL_HOST.
• SSH_SERVER: The server you SSH into.

You're developing a web app on your laptop at localhost:3000. You want to show it to a colleague, but they're on a different network.

You can use remote forwarding to make your local app accessible via a port on your public SSH server (e.g., my-server.com:8080).

Let's expose your local web app running on localhost:3000 via port 8080 on my-server.com.

ssh -R 8080:localhost:3000 user@my-server.com

Now, your colleague can access your app by navigating to http://my-server.com:8080 in their browser!

SSH port forwarding is a powerful tool. Which statements accurately describe its usage?

You've mastered SSH port forwarding!

• Local forwarding (-L) connects your local port to a remote service.
• Remote forwarding (-R) connects a remote server's port to your local service.

These techniques create secure, encrypted tunnels, letting you manage network access effectively. Keep practicing to integrate them into your workflow!