SSH tunneling (port forwarding) in Linux CLI - Deep Dive

Overview - SSH tunneling (port forwarding)

What is it?

SSH tunneling, also called port forwarding, is a way to securely send data from one computer to another through an encrypted connection. It lets you forward network traffic from a local port on your machine to a remote port on another machine using SSH. This means you can access services on remote computers as if they were running on your own computer, safely and privately.

Why it matters

Without SSH tunneling, accessing remote services over the internet can be risky because data might be exposed to attackers. SSH tunneling protects your data by encrypting it, making it safe to use public networks or bypass firewalls. It also helps when direct access to a service is blocked or restricted, allowing you to reach it through a secure path.

Where it fits

Before learning SSH tunneling, you should understand basic SSH usage and networking concepts like ports and IP addresses. After mastering SSH tunneling, you can explore advanced SSH features, VPNs, and secure remote administration techniques.

Mental Model

Core Idea

SSH tunneling creates a secure, encrypted pipe that forwards network traffic from one port on your computer to another port on a remote machine.

Think of it like...

Imagine a secret tunnel under a busy street that lets you safely carry messages from your house to a friend's house without anyone seeing or intercepting them.

Local Machine                      Remote Machine
┌───────────────┐                 ┌───────────────┐
│ Local Port    │───┐             │ Remote Port   │
│ (e.g., 8080)  │   │ SSH Tunnel  │ (e.g., 80)    │
└───────────────┘   ├────────────▶└───────────────┘
                    │
                    │ Encrypted Connection
                    │
                    ▼

Build-Up - 7 Steps

1

Foundation

Understanding SSH Basics

Concept: Learn what SSH is and how it creates a secure connection between two computers.

SSH (Secure Shell) is a protocol that lets you log into another computer securely over a network. It encrypts all data sent between your computer and the remote one, protecting passwords and commands from being seen by others. You usually connect using a command like: ssh user@remote_host

Result

You can securely access the remote computer's command line.

Understanding SSH is essential because tunneling builds on this secure connection to forward ports safely.

2

Foundation

What Are Ports and Why Forward Them?

Concept: Ports are like doors on a computer that let different services communicate. Forwarding ports means redirecting traffic from one door to another.

Every service on a computer listens on a specific port number (like 80 for web servers). Sometimes, you want to access a service on a remote computer that is not directly reachable. Port forwarding lets you send traffic from a local port on your machine through SSH to a remote port, making it seem like the service is local.

Result

You understand that port forwarding connects local and remote services through specific ports.

Knowing ports and forwarding helps you grasp why SSH tunneling is useful for accessing blocked or remote services.

3

Intermediate

Local Port Forwarding Explained

🤔Before reading on: do you think local port forwarding sends data from your local machine to a remote service, or from the remote machine to your local service? Commit to your answer.

Concept: Local port forwarding sends traffic from a port on your local machine through SSH to a port on a remote machine.

You run a command like: ssh -L 8080:localhost:80 user@remote_host This means: when you connect to localhost:8080 on your computer, the traffic is securely sent to port 80 on the remote machine. This is useful to access remote web servers or databases as if they were local.

Result

Accessing http://localhost:8080 in your browser shows the remote web server's page.

Understanding local forwarding lets you securely access remote services without exposing them directly to the internet.

4

Intermediate

Remote Port Forwarding Explained

🤔Before reading on: do you think remote port forwarding lets the remote machine access your local services, or your local machine access remote services? Commit to your answer.

Concept: Remote port forwarding allows a remote machine to forward traffic to a port on your local machine through SSH.

You run a command like: ssh -R 9090:localhost:3000 user@remote_host This means: when someone connects to port 9090 on the remote machine, the traffic is sent through SSH to port 3000 on your local machine. This is useful to share local services with remote users securely.

Result

Remote users connecting to remote_host:9090 access your local service on port 3000.

Knowing remote forwarding helps you share local services securely without exposing them publicly.

5

Intermediate

Dynamic Port Forwarding with SOCKS Proxy

🤔Before reading on: do you think dynamic forwarding forwards a fixed port or can handle multiple ports dynamically? Commit to your answer.

Concept: Dynamic port forwarding creates a local SOCKS proxy that can forward traffic to many different ports dynamically through SSH.

You run: ssh -D 1080 user@remote_host This sets up a SOCKS proxy on your local machine at port 1080. You can configure your browser or apps to use this proxy, and all their traffic will be securely tunneled through SSH to the remote machine, which then connects to the internet.

Result

Your browser traffic is encrypted and appears to come from the remote machine.

Dynamic forwarding is powerful because it lets you tunnel many connections securely without setting up individual port forwards.

6

Advanced

Combining Multiple Forwardings and Security

🤔Before reading on: do you think stacking multiple forwards in one SSH command is possible and safe? Commit to your answer.

Concept: You can combine local, remote, and dynamic forwarding in one SSH session, but must manage security carefully.

Example command: ssh -L 8080:localhost:80 -R 9090:localhost:3000 -D 1080 user@remote_host This opens multiple tunnels simultaneously. However, exposing remote ports can be risky if not controlled by firewall or SSH config. Use options like 'GatewayPorts' and 'AllowTcpForwarding' in sshd_config to limit access.

Result

Multiple tunnels work together, but security settings control who can connect.

Understanding combined forwarding and security settings prevents accidental exposure of sensitive services.

7

Expert

SSH Tunneling Internals and Performance

🤔Before reading on: do you think SSH tunneling encrypts data once or multiple times when forwarding through several hops? Commit to your answer.

Concept: SSH tunneling encrypts data end-to-end between client and server, but multiple hops can add layers and affect performance.

SSH creates an encrypted channel between your local SSH client and the remote SSH server. When forwarding ports, data is wrapped inside this channel. If you chain tunnels (jump hosts), data is decrypted and re-encrypted at each hop, adding latency. Also, SSH compression can improve speed but may increase CPU usage.

Result

You understand the tradeoff between security layers and performance in complex tunnels.

Knowing internals helps optimize tunnels for speed and security in production environments.

Under the Hood

SSH tunneling works by creating an encrypted TCP connection between the SSH client and server. When you forward a port, the SSH client listens on a local port and forwards any traffic through the encrypted SSH channel to the SSH server, which then connects to the target port on the remote machine. This forwarding is handled by the SSH protocol's channel multiplexing feature, allowing multiple forwarded ports over one connection.

Why designed this way?

SSH tunneling was designed to leverage the existing secure SSH connection to safely forward arbitrary TCP traffic without needing separate VPNs or complex firewall rules. This design keeps the implementation simple, secure, and flexible, using encryption already established for remote login.

Local App
  │
  ▼
Local Port Listener (SSH Client)
  │
  │ Encrypted SSH Channel
  │─────────────────────────────▶
  ▼                             
SSH Server Port Forwarding
  │
  ▼
Remote Target Service

Multiple forwarded ports share the same encrypted SSH connection using multiplexed channels.

Myth Busters - 4 Common Misconceptions

Quick: Does local port forwarding expose the remote service directly to the internet? Commit to yes or no.

Common Belief: Local port forwarding makes the remote service publicly accessible on the internet.

Reality: Local port forwarding only forwards traffic from your local machine to the remote service; it does not expose the remote service to others on the internet.

Why it matters: Believing this can cause unnecessary fear or misconfiguration, preventing safe use of local forwarding.

Quick: Can remote port forwarding be used without SSH authentication? Commit to yes or no.

Common Belief: Remote port forwarding can be set up without authenticating to the SSH server.

Reality: SSH authentication is always required to establish remote port forwarding; it cannot be done anonymously.

Why it matters: Thinking otherwise risks attempts to bypass security, which is not possible and wastes time.

Quick: Does dynamic port forwarding forward traffic only to one fixed port? Commit to yes or no.

Common Belief: Dynamic port forwarding only forwards traffic to a single remote port like local forwarding.

Reality: Dynamic port forwarding acts as a SOCKS proxy, forwarding traffic to many different ports dynamically based on the client's requests.

Why it matters: Misunderstanding this limits the use of dynamic forwarding and its flexibility.

Quick: Is SSH tunneling always faster than direct connections? Commit to yes or no.

Common Belief: SSH tunneling speeds up network connections because it compresses data.

Reality: SSH tunneling adds encryption overhead and can slow down connections, especially over multiple hops or with heavy encryption.

Why it matters: Expecting speed improvements can lead to confusion when tunnels feel slower than direct access.

Expert Zone

1

SSH tunnels can be multiplexed over a single connection to reduce overhead and improve performance.

2

The 'GatewayPorts' setting controls whether remote forwarded ports listen on all interfaces or just localhost, affecting security.

3

Compression in SSH tunnels can help with slow networks but may increase CPU load and latency.

When NOT to use

Avoid SSH tunneling when you need to forward UDP traffic or require high-performance VPN features; use VPN solutions like WireGuard or OpenVPN instead.

Production Patterns

In production, SSH tunnels are often combined with systemd services or autossh to maintain persistent tunnels. They are used for secure database access, remote debugging, and bypassing firewalls in controlled environments.

Connections

Virtual Private Network (VPN)

Both create secure encrypted tunnels for network traffic, but VPNs operate at the network layer while SSH tunneling works at the application/port level.

Understanding SSH tunneling clarifies how VPNs provide broader network access, while SSH tunnels focus on specific ports.

Proxy Servers

Dynamic SSH tunneling acts like a SOCKS proxy, forwarding traffic on behalf of clients.

Knowing SSH dynamic forwarding helps understand how proxies route and anonymize traffic.

Secure Courier Delivery

Like a courier who securely transports packages through guarded routes, SSH tunneling securely transports data through encrypted channels.

This cross-domain view highlights the importance of secure pathways in both physical and digital communication.

Common Pitfalls

#1 Trying to forward a port without specifying the correct remote host or port.

Wrong approach:

ssh -L 8080 user@remote_host

Correct approach:

ssh -L 8080:localhost:80 user@remote_host

Root cause:

Omitting the remote host and port in the forwarding syntax causes SSH to fail or forward incorrectly.

#2 Assuming remote port forwarding listens on all network interfaces by default.

Wrong approach:

ssh -R 9090:localhost:3000 user@remote_host
# Remote port accessible from any IP

Correct approach:

Configure sshd_config with GatewayPorts yes and then run:
ssh -R 9090:localhost:3000 user@remote_host

Root cause:

By default, remote forwarded ports listen only on localhost for security, so external access requires explicit server config.

#3 Using SSH tunneling to forward UDP traffic.

Wrong approach:

ssh -L 5353:localhost:5353 user@remote_host # expecting UDP forwarding

Correct approach:

Use VPN solutions like WireGuard for UDP traffic, as SSH only forwards TCP.

Root cause:

SSH protocol only supports TCP forwarding, so UDP traffic cannot be tunneled this way.

Key Takeaways

SSH tunneling securely forwards network traffic by creating encrypted connections between local and remote ports.

Local, remote, and dynamic forwarding serve different use cases for accessing or sharing services securely.

Understanding SSH tunneling internals helps optimize performance and maintain security in complex setups.

Misconceptions about exposure, authentication, and traffic types can lead to security risks or failed connections.

SSH tunneling is a flexible tool but has limits; knowing when to use VPNs or proxies is essential for effective network security.