Title: Manage SSH Tunnels
Course: CIS 208: Linux/UNIX III: Intermediate System Administration, Networking, and Security ~ For IGNITE Review > Section: Learning Modules

Manage SSH tunnels

The SSH program supports the creation of tunnels, which are encrypted pathways through untrusted networks. In this sense, they are similar to a Virtual Private Network (VPN) although a VPN connection will support multiple ports and each SSH tunnel only supports one port.

"SSH-tunnel-en.svg" by Trex2001 is licensed under CC BY 3.0

The simplest use case would be to encrypt connections on port 80 to a webserver.

- This requires the user to have an account on the webserver and make an SSH connection, like this: ssh -fNL 80:localhost:80 webserver.domain.tld.
- Then connect to http://localhost.
- This will create a tunnel between 127.0.0.1:80 on the client and 127.0.0.1:80 on the webserver.

A more complex example involves a test web server which cannot connect to the Internet, but does have a jumpbox (a server on the internal network that accepts ssh connections from the Internet).

- In this case the user will connect to the jumpbox:  ssh -fNL 80:testweb:80 jumpbox.domain.tld.
- Then connect to http://localhost.
- This will create a tunnel from 127.0.0.1:80 on the client to 127.0.0.1:80 on the test server.

Both of the above examples show forward tunnels, since the SSH command is run on the client.  It is also possible to set up a reverse tunnel, where the ssh command is run on the server.  For example, consider the case of a server which can connect using ssh to the Internet, but does not have a jumpbox on its local network.

- Set up a reverse tunnel by connecting to the client computer from the server: ssh -fNR 2222:localhost:22 user@client.domain.tld.
- Now the client computer will have a new listener on port 2222 and can run: ssh -p 2222 localhost.
- The client will use the tunnel to connect directly to the remote server.

These are just three examples of the kinds of tunnels that can be set up.  See the man page of ssh for more information.