Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was wondering whether it is possible to get port forwarding without being root or ssh.

Currently I do

ssh -L 20080:othermachine:80 localhost

Using ssh can get you certain benefits like creating encrypted tunnels etc. In the above example I don't do that so using ssh seems unnecessary overhead. Is there an easier way to do this?

I suppose it is not that hard to create a program that reads all data on one socket and sends it to another and vice versa. There must be some tool that does that job better than I can ever write.

share|improve this question
You wouldn't need root for that example. – Arjan Oct 3 '09 at 14:04
I think I should have made clearer that I did not have a particular problem. It was more that although this worked, I thought there must be other solutions that could be better. (As for the root part, I would be able to use port forwarding with iptables, but that would require root.) – BlackShift Oct 4 '09 at 12:17
up vote 7 down vote accepted

i would also prefer ssh BECAUSE of the encryption, but 'socat' should work fine for you as well.

share|improve this answer
Thanks! never heard of socat, this program can do much more than I ever hoped. I'm sure I'll find more uses for it than just port forwarding. – BlackShift Oct 4 '09 at 12:04

You ask: Is there an easier way to do this? The simple answer would be 'no'. SSH does what you need, and it's a well-used, well-know, very efficient program with (I would imagine) very few bugs, it's available on every platform you can imagine, and it's secure to boot. You don't state that performance is an issue, so I don't see a reason why not to use SSH, personally.

If you want to forward a local port to a port on a different machine, you need something that will authenticate on that remote host. That's SSH. If you only want to mess with local ports, then as mentioned already, socat may be just what you're looking for.

share|improve this answer
There was not a specific reason to not use ssh at this time, but I wanted to broaden my collection of tools, and socat seems very powerful. (akira was first to propose it, so I checked his answer.) – BlackShift Oct 4 '09 at 12:10
btw, three reasons when ssh is not optimal: 1) it is not available (like on my phone, but I doubt I can install socat there), 2) no sshd, or in my case a limited amount of allowed logins, 3) no account on the remote machine (so an encrypted/compressed tunnel is not possible anyway) – BlackShift Oct 4 '09 at 12:12
Another case where ssh is not optimal is when you are moving large quantities of data and have limited processing power available. The CPU load imposed by ssh's encryption is large in this case and also slows transfers. Still, this doesn't mean that you can neglect security for the sake of performance, however in some cases, the layer of security is unnecessary (such as you are communicating over a private network) – wojtow Dec 19 '15 at 8:10

If what you are doing works, and you aren't seeing any performance problems, I wouldn't change anything. If you aren't transferring large amounts of data, it shouldn't have much of an impact. And if you are, ssh can compress the data, so you still might be better off.

The only problem might be with latency. It looks like you are tunneling http traffic, so it should be negligible.

share|improve this answer
(From man ssh: Compression is desirable on modem lines and other slow connections, but will only slow down things on fast networks.) – Arjan Oct 3 '09 at 13:52
I saw that, but don't quite agree. It depends on the speed of the network, the speed of the network, and the amount of data being moved. I have had good experience using it for large (multi gigabyte) amounts of data over GigE networks using fast servers. – KeithB Oct 3 '09 at 17:30

Whatever tool you use: when not using Windows then you will always (and only) need to run with superuser privileges when using privileged ports ("well known ports"). So: when using ports up to and including 1023.

share|improve this answer
forwarding to a low port (that is already listening) does not require superuser privileges, only for the accepting port (which was 10080 in my example). – BlackShift Oct 4 '09 at 12:15

Just a quick note, it seems that ncat that comes with the new nmap 5 can do similar things as socat:

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .