MobaXterm MobaSSH Tunnel Settings: A Comprehensive Guide

Configure MobaXterm MobaSSH tunnels by opening the Session Manager, selecting your SSH session, and navigating to the "Tunnel" tab. Here you can define local port forwarding rules that map a local port on your machine to a specific host and port on the remote server. This setup allows secure access to internal services without exposing them directly to the public internet.

Accessing the Tunnel Configuration Interface

The foundation of any SSH tunnel configuration in MobaXterm begins with the Session Manager. To access these settings, launch MobaXterm and click on the Session button located in the top-left corner of the window. This action opens a dialog box where you can create new connections or modify existing ones. For this guide, we assume you are either creating a new SSH session or editing an existing one that connects to a Linux or Unix-based server. Once inside the Session dialog, ensure the SSH radio button is selected. Enter the hostname or IP address of the remote server in the designated field. Before clicking OK to establish the connection, it is crucial to configure the tunnel parameters. Click on the Tunnel tab within this same dialog box. If this tab is not visible, verify that you have administrative privileges or that your version of MobaXterm includes the full suite of networking features. The interface will present a list of existing tunnel rules if any have been saved previously.

Understanding Local Port Forwarding

Local port forwarding is the most common use case for SSH tunnels. It allows you to access a service running on the remote server as if it were running locally on your machine. In the Tunnel tab, you will see fields labeled Local port, Remote host, and Remote port. To set up a basic tunnel, follow these steps:

1. Local Port: Specify the port number on your local machine that you want to listen on. For example, use 8080 to access a web service remotely.
2. Remote Host: Enter the destination host. If the service is running on the same server you are connecting to, use localhost or 127.0.0.1. If you need to reach another machine behind the firewall, enter its internal IP address.
3. Remote Port: Enter the port number of the service on the remote side. For instance, if you are forwarding traffic to a database, this might be 3306.

After filling in these fields, click Add to append the rule to the list. You can add multiple rules to forward different services simultaneously. For example, you might forward local port 9090 to remote host 192.168.1.50 on remote port 80 for a secondary web application.

Configuring Reverse Tunnels

Reverse tunnels operate differently from local forwards. They allow a remote server to connect back to a service on your local machine. This is particularly useful when your local computer is behind a NAT or firewall and cannot accept incoming connections directly. To configure a reverse tunnel, check the Reverse checkbox next to the tunnel rule before adding it. When using a reverse tunnel, the roles of the ports are effectively swapped from the perspective of the connection initiation. The Local port becomes the destination on your local machine, while the Remote host and Remote port define the listening point on the server. Ensure that the remote server's SSH daemon is configured to permit reverse port forwarding. If the server rejects the request, you may need to adjust the GatewayPorts setting in the server's sshd_config file, although MobaXterm handles the client-side negotiation automatically. For advanced scenarios involving dynamic application-level port mapping, consider exploring how to manage persistent connections to prevent dropouts. See Troubleshooting Autossh/Ssh Failure Setting Tunnel with ExitOnForwardFailure for insights on maintaining stable tunnel links.

Verifying and Testing Your Tunnel

Once your tunnel rules are added, click OK to save the session configuration. MobaXterm will now attempt to establish the SSH connection along with the specified port forwards. Upon successful authentication, you can test the tunnel by opening a web browser or terminal on your local machine and accessing http://localhost:LOCAL_PORT. If the connection is established, you should see the content served by the remote service. If the connection fails, check the MobaXterm session log for error messages. Common issues include permission denied errors on the remote host, which indicate that the user does not have the necessary privileges to open the specified port. Another frequent problem is port conflicts on the local machine, where another application is already using the desired local port. Ensure that no other services are bound to the same local port number. For users experiencing disconnections during heavy usage, optimizing terminal settings can improve stability. Review How to Save MobaXterm Terminal Settings with Implicit CR every LF to ensure your session parameters align with best practices for data integrity.

Managing Existing Tunnels

MobaXterm stores tunnel configurations within the session profile. To modify or remove a rule, reopen the Session Manager, select your SSH session, and go back to the Tunnel tab. You can edit an existing rule by double-clicking it or remove it entirely by selecting it and clicking Delete. Changes are applied only after you reconnect to the server. It is important to note that tunnel rules are not global settings; they are tied to specific sessions. If you have multiple servers requiring similar tunnel setups, you must configure each session individually. However, you can export and import session files to share configurations across different machines or users. This feature is particularly helpful for IT administrators managing standardized environments. For troubleshooting connectivity issues such as unexpected closures, refer to Troubleshooting 'Remote side unexpectedly closed network connection' Error in MobaXterm to diagnose underlying network instability.

Frequently Asked Questions

Can I forward multiple ports at once?

Yes, you can add multiple tunnel rules in the same session. Each rule operates independently, allowing you to forward different local ports to various remote hosts and ports simultaneously. Just ensure that all local ports used are unique and available on your machine.

Why is my tunnel failing to connect?

Common causes include incorrect remote host addresses, blocked ports by firewalls, or insufficient permissions on the remote server. Check the MobaXterm log for specific error codes and verify that the remote service is actually running and listening on the specified port.

Do I need root access on the remote server?

Generally, no. Standard users can forward ports above 1024 without special privileges. However, if you attempt to forward a privileged port (below 1024) on the remote side, you may need sudo or root access depending on the server's security policies.

How do I disable a tunnel temporarily?

You cannot disable a tunnel without removing the rule. To temporarily stop forwarding, delete the rule from the Tunnel tab, save the session, and reconnect. You can re-add the rule later when you need the tunnel again.

Is MobaSSH tunneling encrypted?

Yes, all data transmitted through an SSH tunnel in MobaXterm is encrypted using the SSH protocol. This ensures that even if the traffic is intercepted, the contents remain secure and unreadable to unauthorized parties.