Setting up Possible Route for Traffic: Connecting Local PC to AWS Instance using Port Forwarding with PuTTY

Port forwarding with PuTTY allows you to securely connect a local Windows 11 machine to an Ubuntu AWS Lightsail instance by tunneling network traffic through SSH. This method bypasses the need for direct public exposure of local services, ensuring that data remains encrypted during transit while enabling seamless access to remote resources as if they were local.

Prerequisites and Instance Configuration

Before configuring PuTTY, ensure your AWS Lightsail instance is running and accessible. You must have the private IP address or public DNS name of your Ubuntu LTS 20.04 instance, along with valid login credentials. Typically, this involves using the ubuntu username for initial access. Verify that the instance's firewall settings allow incoming SSH connections on port 22 from your current IP address. If you are planning to forward specific ports for web services or databases, ensure those ports are also open in the Lightsail networking tab. This foundational step prevents connection timeouts caused by security groups blocking the initial handshake.

Configuring PuTTY Session Settings

Launch PuTTY and enter the hostname or IP address of your AWS instance in the "Host Name (or IP address)" field. Set the connection type to SSH and ensure the port is 22. Navigate to the Connection category in the left-hand menu, then select Data. Enter ubuntu in the "Auto-login username" box to streamline the authentication process. Under the SSH category, click on Tunnels. This section is critical for establishing the port forwarding rules. Here, you will define how traffic from your local machine is redirected to the remote instance. Ensure that "Enable SSH agent forwarding" is unchecked unless specifically required for git operations, as this can sometimes cause permission issues with local keys.

Setting Up Local Port Forwarding

Local port forwarding maps a port on your local Windows PC to a port on the remote Linux server. In the Tunnels section, select the Local radio button. In the "Source port" field, enter a local port number that is not currently in use by another application, such as 8080. For the "Destination" field, specify the target host and port on the remote server. For example, if you want to access a web server running on the AWS instance at port 80, enter localhost:80. Click Add to register this rule. The tunnel entry should now appear in the list below. This configuration tells PuTTY to listen on your local port 8080 and forward any incoming connections to port 80 on the remote instance.

Establishing the Connection and Testing

Return to the Session category and save your configuration by giving it a name in the "Saved Sessions" box. Click Open to initiate the connection. Upon successful authentication, a terminal window will appear, indicating that you are logged into the Ubuntu instance. To test the port forwarding, open a web browser on your Windows PC and navigate to http://localhost:8080. If configured correctly, you should see the content served by the web application running on the AWS instance. This confirms that the traffic has been successfully tunneled through the encrypted SSH channel. You can verify the active tunnels by checking the PuTTY window title bar, which typically displays the active port forwarding rules.

Advanced Tunneling Options

While local forwarding is common, dynamic port forwarding via SOCKS proxies offers greater flexibility for browsing multiple remote services. Select the Dynamic radio button in the Tunnels menu and set a source port, such as 1080. Add this tunnel and connect. Configure your system-wide proxy settings or individual applications like Firefox to use a SOCKS5 proxy at 127.0.0.1:1080. This routes all application traffic through the SSH tunnel, effectively masking your origin IP for those applications. Note that this requires careful configuration of client applications to respect the proxy settings. For most single-service needs, local forwarding remains the more straightforward and secure option.

Security Best Practices

Always keep your PuTTY software updated to mitigate known vulnerabilities. Use strong, complex passwords or, preferably, SSH key pairs for authentication to prevent brute-force attacks. Disable password authentication on the AWS instance if possible, allowing only key-based logins. Regularly review the active sessions and terminated connections in the AWS console to detect unauthorized access attempts. Additionally, consider using a firewall on the Ubuntu instance to restrict access to forwarded ports to trusted IP addresses only. These measures ensure that the convenience of port forwarding does not compromise the security of your cloud infrastructure.

Frequently Asked Questions

Can I forward multiple ports simultaneously?

Yes, you can add multiple entries in the Tunnels section before connecting. Each entry requires a unique local source port but can point to different destinations or the same destination on different ports. This allows you to access various services like SSH, HTTP, and database interfaces concurrently through separate local ports.

Why does my browser show a connection refused error?

This usually indicates that no service is listening on the specified destination port on the remote server, or the firewall is blocking it. Verify that the application on the Ubuntu instance is running and bound to the correct interface. Check the Lightsail firewall rules to ensure the specific port is allowed inbound traffic.

Is port forwarding safe for production environments?

Port forwarding itself is secure because it uses encrypted SSH channels. However, exposing internal services directly to the internet via forwarding should be done cautiously. It is best suited for administrative access or development environments rather than public-facing production endpoints. Always combine it with strong authentication and network segmentation.

How do I remove a saved session in PuTTY?

Open PuTTY, go to the Saved Sessions list, highlight the session you wish to delete, and click the Delete button. This removes the configuration from the registry without affecting the actual connection history or logs. Be sure to export important configurations before deleting them if you might need them later.