Home‎ > ‎

Using SSH tunnels for remote connections

posted Feb 2, 2011, 1:11 AM by Jayme Snyder   [ updated Apr 28, 2011, 3:01 PM ]
So I found myself in a situation today where I wanted to copy a file off my computer onto a remote machine located inside another network.
I control the network, but there are security concerns which prevent me from wanting to use RDP or put any password that is used elsewhere into memory on this remote machine. I was also behind NAT from my client PC. Instead of copying the file to another machine which was directly accessible with a webserver, and then pull it from there, I decided just use a SSH tunnel to bind my port 80 to a server accessible to both.

Basically port forwarding from your client accessible network to a remote server:

On the SSH server that will become the server providing your content:
edit /etc/sshd_config
Add: GatewayPorts yes
restart sshd (in my case freebsd, so /etc/rc.d/sshd restart)

On the client with access to the network with the service you want to map/distribute:
ssh -R \*:<remote-server-port>:<local-server-with-content>:<local-server-port> <username>@<remote-server-that-will-provide-content>

So in my case, the server running on my local machine one port 80 to a remote machine on 8080 would look like this:
ssh -g -R \*:8080:localhost:80 ns1.00000000.ca

Please note this is actually a major heads up to think about network security. Even if you are protecting a network with stateful packet inspection, remember that  traffic which was established from trusted networks to outside can tunnel untrusted connections back in - so in a truly secure network one must enforce security on outbound traffic.


Comments