Forward TCP Packets Using SSH

SSH port forwarding allows you to securely tunnel TCP traffic between two hosts by encapsulating it within an encrypted SSH connection. This technique is essential for accessing remote services that are not directly exposed to the public internet, such as databases, web servers, or internal APIs. By leveraging the SSH protocol, you can bypass firewalls and NAT restrictions while maintaining data confidentiality and integrity.

Local Port Forwarding

Local port forwarding creates a listening socket on your local machine and forwards all traffic from that socket to a specified destination through the SSH server. This is commonly used to access a service running on the remote server's localhost or another host reachable from the remote server. The syntax for this operation is straightforward and works identically on both Linux and Windows systems when using standard OpenSSH clients. To establish a local forward, use the -L flag followed by the local port, the destination host, and the destination port. For example, if you want to access a database running on db.example.com at port 5432 via your SSH server, you would run:

ssh -L 5432:db.example.com:5432 [email protected]

This command binds port 5432 on your local machine. Any connection made to localhost:5432 will be tunneled through the SSH connection to [email protected], which then connects to db.example.com:5432. It is crucial to ensure that the SSH server has permission to connect to the destination host. If the destination is unreachable from the SSH server, the tunnel will fail even if the local configuration is correct. You can verify connectivity by testing the tunnel with tools like telnet or nc after establishing the SSH session.

Remote Port Forwarding

Remote port forwarding reverses the direction of traffic. It listens on the remote SSH server and forwards incoming connections back through the SSH tunnel to a service on your local machine. This is particularly useful when you need to expose a local development server to a remote network without opening ports on your local firewall. The syntax uses the -R flag instead of -L. For instance, to expose your local web server running on port 8080 to the remote server's port 80, you would execute:

ssh -R 80:localhost:8080 [email protected]

Once connected, anyone who can reach ssh-server.com:80 will have their traffic forwarded to your local machine's port 8080. However, modern SSH configurations often restrict remote forwarding by default for security reasons. You may need to configure the sshd_config file on the remote server to allow this behavior. Specifically, the GatewayPorts directive must be set appropriately. If GatewayPorts is set to no (the default), the forwarded port will only listen on the loopback interface of the remote server. Setting it to yes allows binding to all interfaces, making the service accessible from other machines on the network.

Dynamic Port Forwarding as a SOCKS Proxy

Dynamic port forwarding acts as a SOCKS proxy server, allowing applications to route their traffic through the SSH tunnel dynamically. This is highly effective for browsing the web securely or accessing multiple remote resources without configuring individual tunnels. The -D flag enables this mode. To create a dynamic proxy on local port 1080, run:

ssh -D 1080 [email protected]

You can then configure any application that supports SOCKS proxies, such as your web browser, to use socks5://localhost:1080. All traffic generated by that application will be encrypted and sent through the SSH server, masking your true IP address from the destinations you visit. This method is significantly more flexible than static port forwarding but requires client-side support for SOCKS protocols. Note that some applications may require additional configuration to handle DNS resolution securely through the proxy, so always check your application's settings.

Windows and Linux Compatibility

The commands described above work seamlessly across Linux and Windows environments. On Linux, the OpenSSH client is typically pre-installed or available via package managers like apt or yum. On Windows 10 and later, the OpenSSH client is included in the operating system by default. You can verify its installation by running ssh -V in PowerShell or Command Prompt. If you encounter connection issues, especially when using WSL or virtual machines, ensure that your SSH daemon is properly configured and that network policies allow the necessary traffic. For troubleshooting specific connectivity problems, refer to our guide on Troubleshooting SSH WSL Machine: Can't Connect to Localhost. Additionally, if you are managing infrastructure with Vagrant, you might face similar SSH hurdles; see Vagrant Fails to Connect to SSH on Linux Host, Works Fine on Windows Host for solutions related to host-specific SSH behaviors.

Security Considerations

While SSH forwarding provides encryption, it does not protect against compromised endpoints. Always ensure that the SSH server you are connecting to is trusted. Avoid using password authentication in favor of key-based authentication to prevent brute-force attacks. Furthermore, limit the scope of forwarded ports to only those necessary for your workflow. Restricting access to specific IP ranges in your firewall rules adds an extra layer of security. Regularly update your SSH software to patch known vulnerabilities.

Frequently Asked Questions

Can I forward UDP traffic using SSH?

No, standard SSH port forwarding only supports TCP traffic. UDP packets cannot be tunneled directly because SSH relies on stream-oriented connections. You would need alternative tools like socat or VPN solutions for UDP forwarding.

Why is my remote port forwarding not accessible from outside?

This usually happens because GatewayPorts is disabled in /etc/ssh/sshd_config on the remote server. By default, remote forwards bind only to localhost. Change this setting to yes and restart the SSH service to allow external access.

Does SSH forwarding slow down my connection?

Yes, there is a slight overhead due to encryption and decryption processes. However, modern CPUs handle this efficiently, and the impact is often negligible for general use. Bandwidth limitations of the SSH server may also affect throughput.

How do I stop a background SSH tunnel?

If you started the tunnel in the background using the -fN flags, you can kill the process by finding its PID using ps aux | grep ssh and then running kill [PID]. Alternatively, close the terminal session if the tunnel was started interactively.

Can I use SSH forwarding over non-standard ports?

Yes, you can specify a different port for the SSH connection itself using the -p flag, such as ssh -p 2222 user@server. The forwarded ports inside the tunnel remain independent of the SSH transport port.