I was wondering whether it is possible to get port forwarding without being root or ssh.

Currently I do

ssh -L 20080:othermachine:80 localhost

Using ssh can get you certain benefits like creating encrypted tunnels etc. In the above example I don't do that so using ssh seems unnecessary overhead. Is there an easier way to do this?

I suppose it is not that hard to create a program that reads all data on one socket and sends it to another and vice versa. There must be some tool that does that job better than I can ever write.

  • You wouldn't need root for that example. – Arjan Oct 3 '09 at 14:04
  • 1
    I think I should have made clearer that I did not have a particular problem. It was more that although this worked, I thought there must be other solutions that could be better. (As for the root part, I would be able to use port forwarding with iptables, but that would require root.) – BlackShift Oct 4 '09 at 12:17

i would also prefer ssh BECAUSE of the encryption, but 'socat' should work fine for you as well.

  • Thanks! never heard of socat, this program can do much more than I ever hoped. I'm sure I'll find more uses for it than just port forwarding. – BlackShift Oct 4 '09 at 12:04
  • A standard persistent port tunnel from port 8880 on localhost to port 80 on target.example.com: socat TCP4-LISTEN:8880,fork,reuseaddr TCP4:target.example.com:80. If you want it to persist after you end your shell session, send it to the background (Ctrl-Z) then bg and disown it disown socal – Rolf Oct 12 '18 at 17:49

You ask: Is there an easier way to do this? The simple answer would be 'no'. SSH does what you need, and it's a well-used, well-know, very efficient program with (I would imagine) very few bugs, it's available on every platform you can imagine, and it's secure to boot. You don't state that performance is an issue, so I don't see a reason why not to use SSH, personally.

If you want to forward a local port to a port on a different machine, you need something that will authenticate on that remote host. That's SSH. If you only want to mess with local ports, then as mentioned already, socat may be just what you're looking for.

  • There was not a specific reason to not use ssh at this time, but I wanted to broaden my collection of tools, and socat seems very powerful. (akira was first to propose it, so I checked his answer.) – BlackShift Oct 4 '09 at 12:10
  • btw, three reasons when ssh is not optimal: 1) it is not available (like on my phone, but I doubt I can install socat there), 2) no sshd, or in my case a limited amount of allowed logins, 3) no account on the remote machine (so an encrypted/compressed tunnel is not possible anyway) – BlackShift Oct 4 '09 at 12:12
  • Another case where ssh is not optimal is when you are moving large quantities of data and have limited processing power available. The CPU load imposed by ssh's encryption is large in this case and also slows transfers. Still, this doesn't mean that you can neglect security for the sake of performance, however in some cases, the layer of security is unnecessary (such as you are communicating over a private network) – wojtow Dec 19 '15 at 8:10

If what you are doing works, and you aren't seeing any performance problems, I wouldn't change anything. If you aren't transferring large amounts of data, it shouldn't have much of an impact. And if you are, ssh can compress the data, so you still might be better off.

The only problem might be with latency. It looks like you are tunneling http traffic, so it should be negligible.

  • (From man ssh: Compression is desirable on modem lines and other slow connections, but will only slow down things on fast networks.) – Arjan Oct 3 '09 at 13:52
  • I saw that, but don't quite agree. It depends on the speed of the network, the speed of the network, and the amount of data being moved. I have had good experience using it for large (multi gigabyte) amounts of data over GigE networks using fast servers. – KeithB Oct 3 '09 at 17:30

Just a quick note, it seems that ncat that comes with the new nmap 5 can do similar things as socat: http://nmap.org/ncat/


Whatever tool you use: when not using Windows then you will always (and only) need to run with superuser privileges when using privileged ports ("well known ports"). So: when using ports up to and including 1023.

  • 2
    forwarding to a low port (that is already listening) does not require superuser privileges, only for the accepting port (which was 10080 in my example). – BlackShift Oct 4 '09 at 12:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.