I have a system that runs several web interfaces I can only connect to via SSH. To get around this I use port forwarding to forward each of the HTTP application ports to my local computer. I would like to be able to connect to this server from other computers from my network local without establishing an SSH session on each.

My current model is using nginx as a proxy and creating a systemd service that runs SSH and forwards the ports locally for nginx to connect to. This works ok, but I'm curious if there are better options for this scenario


You'll need to forward ports no matter what, since they are inaccessible directly.

nginx in this case is probably the simplest, as you don't have to establish the port forwarding yourself once nginx is configured.

--end of answer--

Keep reading for another method, but isn't so simple.

If you want to play with another method, you can use ssh to act like a SOCKS server to do the forwarding and use a browser plugin, such as FoxyProxy for firefox, or SwitchyOmega for Chrome, to use it when certain IPs are referenced. Last I tried, FoxyProxy required SOCKS4, and SwitchyOmega could use SOCKS5.

This method does require changes on all the computers attempting to use it... again, this is just for information.

On a server you can access, which also has access to the web services of interest, such as where you're running nginx now, run

ssh -f -N -D 9999 -o GatewayPorts=yes localhost

9999 could be any unused port that you have permission to establish a connection on.

If this system reboots, you too will need to figure a way to run automatically on reboot, say for example /etc/rc.local or create a systemd service.

The SOCKS proxy can also be used to get to other machines not directly accessible by using ssh and ProxyCommand in ~/.ssh/config:

#Host           some-ip-or-range-not-directly-accessible
Host            192.168.*
ProxyCommand    nc -X 5 -x socks-server:9999 %h %p
#                  -X 4 for SOCKS4
#                  socks-server is where you ran above ssh command

nc or netcat will most likely have to be installed first.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.