{"id":2292,"date":"2022-04-02T11:40:15","date_gmt":"2022-04-02T08:40:15","guid":{"rendered":"http:\/\/kifarunix.com\/?p=2292"},"modified":"2024-03-09T12:21:14","modified_gmt":"2024-03-09T09:21:14","slug":"how-to-configure-ssh-local-port-forwarding-in-linux","status":"publish","type":"post","link":"https:\/\/kifarunix.com\/how-to-configure-ssh-local-port-forwarding-in-linux\/","title":{"rendered":"Configure SSH Local Port Forwarding in Linux"},"content":{"rendered":"\n<p>Welcome to our guide on how to configure SSH Local Port Forwarding in Linux. In order to understand how SSH tunneling or simply put, port forwarding, works, we are going to see the example usage in this guide.<\/p>\n\n\n\n<p>There are three types of SSH Tunneling;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><code>local port forwarding<\/code>: This involves forwarding traffic on a local port on your local machine to a specific port on remote server. The local SSH client listens for a connection on a specific port and when it receives a connection, it tunnels it to SSH server which then connects to a specific destination port.<\/li>\n\n\n\n<li><code>remote port forwarding<\/code>: This allows connection from a remote machine to a local server.<\/li>\n\n\n\n<li><code>dynamic port forwarding<\/code>: This is a type of forwarding which allows communications to happen over a wide range of ports rather than a single port as in the case for local or remote port forwarding.<\/li>\n<\/ul>\n\n\n\n<p>In this tutorial, we will focus only on configuring SSH local port forwarding.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Configure SSH Local Port Forwarding in Linux<\/h2>\n\n\n\n<p>Some of the typical use cases for local ssh port forwarding include;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><em>Tunneling sessions and file transfers through&nbsp;jump servers<\/em><\/li>\n\n\n\n<li><em>Connecting to a service on an internal network from the outside<\/em><\/li>\n\n\n\n<li><em>Connecting to a remote file share over the Internet<\/em><\/li>\n<\/ul>\n\n\n\n<p>Local SSH port forwarding can be initiated by passing option <strong><code>-L<\/code><\/strong> to ssh using the syntax below;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ssh -L &#91;bind_address:]port:host:hostport jump-server<\/code><\/pre>\n\n\n\n<p>Where;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong><code>[bind_address:]<\/code><\/strong> is an optional local system IP address to bind the local connection to.<\/li>\n\n\n\n<li><strong><code>port<\/code><\/strong>: local port to listen for connection on the local host<\/li>\n\n\n\n<li><strong><code>host<\/code><\/strong>: remote host to forward the connections to<\/li>\n\n\n\n<li><code><strong>hostport<\/strong><\/code>: remote local port on the remote host to forward connections to.<\/li>\n\n\n\n<li><strong><code>jump-server<\/code><\/strong>: is the server that basically can connect to the remote host via the specified remote local port. It can be public facing IP address of the same server running a local service to connect to remotely.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Scenario 1<\/h3>\n\n\n\n<p>Assume that you have a VNC server started on localhost with (vncserver -localhost) on remote host, 192.168.58.92, then in order for you to remotely connect to the local VNC server on this host, you need to forward the traffic on a specific port from your host to the local VNC server port via the host IP, 192.168.58.92. In this case, the SSH on the host 192.168.58.92 should be accessible on the IP 192.168.58.92 for you to be able to forward the traffic.<\/p>\n\n\n\n<p>Such a command would be used;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ssh -L 5901:localhost:5908 user@192.168.58.92<\/code><\/pre>\n\n\n\n<p>This command forwards all traffic to port port 5901 (on all interfaces) on your host to port 5908 on the remote localhost via the 192.168.58.92 host.<\/p>\n\n\n\n<p>You can also bind your host port to a specific IP;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ssh -L 127.0.0.1:5901:localhost:5908 user@192.168.58.92<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Scenario 2<\/h3>\n\n\n\n<p>On the remote host 192.168.58.38, we have a web server which can only be allowed to be accessed from the host 192.168.58.21.<\/p>\n\n\n\n<p>So, how can you be able to access the remote web service on host 192.168.58.38 on your local machine via the jump server 192.168.58.21?<\/p>\n\n\n\n<p>The only way is by creating a local port on your machine and forward the traffic to that port to the web server port on host 192.168.58.38 via 192.168.58.21;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ssh -L 127.0.0.1:8080:192.168.58.38:80 kifarunix@192.168.58.21<\/code><\/pre>\n\n\n\n<p>The command above opens port 8080 on my local machine and forwards all traffic to this port to web service port 80 on host 192.168.58.38 via SSH on 192.168.58.21.<\/p>\n\n\n\n<pre class=scroll-box>\nkifarunix@192.168.58.21's password: \nLinux debian11 5.10.0-8-amd64 #1 SMP Debian 5.10.46-4 (2021-08-03) x86_64\n\nThe programs included with the Debian GNU\/Linux system are free software;\nthe exact distribution terms for each program are described in the\nindividual files in \/usr\/share\/doc\/*\/copyright.\n\nDebian GNU\/Linux comes with ABSOLUTELY NO WARRANTY, to the extent\npermitted by applicable law.\nWeb console: https:\/\/debian11:9090\/ or https:\/\/10.0.2.15:9090\/\n\nLast login: Sat Apr  2 04:03:29 2022 from 192.168.58.1\nkifarunix@debian11:~$ \n<\/code><\/pre>\n\n\n\n<p>You can also configure SSH session to run on background by using option <strong><code>-f<\/code><\/strong> and disable remote command execution, <strong><code>-N<\/code><\/strong>.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ssh -f -N -L 127.0.0.1:8080:192.168.58.38:80 kifarunix@192.168.58.21<\/code><\/pre>\n\n\n\n<p>Or just;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ssh -fNL 127.0.0.1:8080:192.168.58.38:80 kifarunix@192.168.58.21<\/code><\/pre>\n\n\n\n<p>Confirm the port is opened on my local machine;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ss -altnp | grep :8080<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>LISTEN    0         128              127.0.0.1:8080             0.0.0.0:*        users:((\"ssh\",pid=343993,fd=5))<\/code><\/pre>\n\n\n\n<p>So if you access <strong><code>http:\/\/127.0.0.1:8080\/<\/code><\/strong> on your browser, you should be able to access the Web service on the remote host.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Configure SSH Local Port Forwarding Using SSH Config&nbsp;File<\/h3>\n\n\n\n<p>With all said above, you can make your life easy by configuring SSH local port forwarding using SSH config&nbsp;file, either <strong><code>~\/.ssh\/config<\/code><\/strong> for user specific or <strong><code>\/etc\/ssh\/ssh_config<\/code><\/strong> for global settings.<\/p>\n\n\n\n<p>The local port forwarding using SSH config file can be done using the sample configs;<\/p>\n\n\n\n<pre class=scroll-box>\nHost    webserver\n        User kifarunix\n        HostName 192.168.58.21\n        LocalForward 127.0.0.1:8080 192.168.58.38:80\n<\/code><\/pre>\n\n\n\n<p>If you have such settings, then to establish the tunnel\/local port forwarding simply run;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ssh -fN webserver<\/code><\/pre>\n\n\n\n<p>Enter the login credentials for SSH.<\/p>\n\n\n\n<p>You can confirm port opening;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>lsof -i :8080<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>COMMAND    PID    USER   FD   TYPE   DEVICE SIZE\/OFF NODE NAME\nssh     404392 mibeyki    5u  IPv6 27604450      0t0  TCP ip6-localhost:http-alt (LISTEN)\nssh     404392 mibeyki    6u  IPv4 27604451      0t0  TCP localhost:http-alt (LISTEN)<\/code><\/pre>\n\n\n\n<p>Read <strong><code>man ssh_config<\/code><\/strong> and check <strong><code>LocalForward<\/code><\/strong>.<\/p>\n\n\n\n<p>And that is it on how to configure SSH local port forwarding.<\/p>\n\n\n\n<p>Read more on <a href=\"https:\/\/www.ssh.com\/academy\/ssh\/tunneling\" target=\"_blank\" rel=\"noreferrer noopener\">SSH Tunneling<\/a><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Other Tutorials<\/h3>\n\n\n\n<p><a href=\"https:\/\/kifarunix.com\/install-and-use-clusterssh-on-ubuntu\/\" target=\"_blank\" rel=\"noreferrer noopener\">Install and Use ClusterSSH on Ubuntu 22.04\/Ubuntu 20.04<\/a><\/p>\n\n\n\n<p><a href=\"https:\/\/kifarunix.com\/setup-secure-ssh-access-on-linux-servers-using-teleport\/\" target=\"_blank\" rel=\"noreferrer noopener\">Setup Secure SSH Access on Linux Servers using Teleport<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Welcome to our guide on how to configure SSH Local Port Forwarding in Linux. In order to understand how SSH tunneling or simply put, port<\/p>\n","protected":false},"author":1,"featured_media":12066,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rank_math_lock_modified_date":false,"footnotes":""},"categories":[121,34,362,1],"tags":[4810,4814,4812,4813,4811,1150],"class_list":["post-2292","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-howtos","category-security","category-ssh","category-uncategorized","tag-configure-ssl-local-port-forwarding-in-linux","tag-how-to-set-up-ssh-tunneling","tag-localforward-ssh","tag-port-forwarding-using-ssh-config-file","tag-ssh-l-f-n","tag-ssh-port-forwarding","generate-columns","tablet-grid-50","mobile-grid-100","grid-parent","grid-50","resize-featured-image"],"_links":{"self":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/2292"}],"collection":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/comments?post=2292"}],"version-history":[{"count":18,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/2292\/revisions"}],"predecessor-version":[{"id":20483,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/2292\/revisions\/20483"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/media\/12066"}],"wp:attachment":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/media?parent=2292"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/categories?post=2292"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/tags?post=2292"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}