I currently use SSH to tunnel my internet connection, using ssh -p <port> -ND <local port> <user>@<ip address>
, and this works great. However, I'd like to bind a local port to a port that's open on the computer I'm SSHing to, but not open to the outside world, so that I can connect to the service on the machine I'm SSHing to on my local machine by references a port (say, 1234) like localhost:1234, instead of, say, remotehost:5678 (which will not work in my situation because of firewall issues).
4 Answers
You need to use the Bind Address option of ssh:
-L [bind_address:]port:host:hostport
Specifies that the given port on the local (client) host
is to be forwarded to the given host and port on the
remote side. This works by allocating a socket to lis‐
ten to port on the local side, optionally bound to the
specified bind_address. Whenever a connection is made
to this port, the connection is forwarded over the
secure channel, and a connection is made to host port
hostport from the remote machine. Port forwardings can
also be specified in the configuration file. IPv6
addresses can be specified by enclosing the address in
square brackets. Only the superuser can forward privi‐
leged ports. By default, the local port is bound in
accordance with the GatewayPorts setting. However, an
explicit bind_address may be used to bind the connection
to a specific address. The bind_address of “localhost”
indicates that the listening port be bound for local use
only, while an empty address or ‘*’ indicates that the
port should be available from all interfaces.
So, for example, to bind local port 1234 to port 6667 of the remote server server.example.com, you would do something like this:
ssh -f -L 1234:localhost:6667 server.example.com
assuming the ssh host is publicly accessible, you probably want to look into Port Knocking Heres one way to apply it to SSH: http://www.marksanborn.net/linux/add-port-knocking-to-ssh-for-extra-security/
take a look here: http://dzervas.gr/notes/ssh-tunnel/ It actually create a socks local proxy where all data is passed are sent to the sshed machine, on any port.
Your question is a little strange, because are you asking How do you set the remote computer up to only take access from your source computer, with ssh?
Or are you asking how do you set it up to restrict access to only allow your computer, with anything, and then connect to it with ssh.
Or are you saying it's already set up like that, how do you now connect with SSH.
Anyhow,
Look at this thread here it mentions a few ways to restrict access, it mentions doing so with SSH or with iptables(a firewall), and if you then want to then connect with SSH, that's just normal.
Why not add in your /etc/host.allow: sshd: IPADDRESS, IPADRRESS
or
Something like this in /etc/ssh/sshd_config perhaps? AllowUsers [email protected].*,1.2.3.4,5.6.7.8
this
The AllowUsers option for sshd_config is the easiest
route if you know who the users are. Alternatively,
there is the equally easy tcp_wrappers way
(/etc/hosts.allow and /etc/hosts.deny).
or
Probably easier to setup a firewall rule something like iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 --source [accepted ip address here] -j ACCEPT
ssh
command is not connected to BASH in any way. In most Linuxes it is part of theopenSSH
package. You can run it using any of a number of shells (BASH,tcsh, zsh whatever) but it is not a part of any of them. That is why I removed the BASH tag, it was misleading since your question is not in any way dependent on BASH.