Is this possible?

  1. local system w/ ssh server
  2. remote client running ssh client connection to (1)
  3. target destination on client's (2) network for local (1) traffic

When the remote ssh client connects to the local ssh server, I want to forward traffic from my local system to another location on the the client system's network.

For example, if I'm doing the forwarding for port 80, then after the client connects via ssh, and local traffic directed to port 80 would be redirected to (3) above.

If possible, and suggested ssh clients that would support this more easily, or is this type of setup command-line only?



The first part of this - creating the tunnel - can be done by the ssh client software.

In the standard command-line ssh client (I'm using a Mac, but believe this behaviour matches unix/linux versions), the usage specifies '-R [bind_address:]port:host:hostport' for a port to be forwarded from the server to the client (whereas -L forwards from the client to the server).

For example, if you want to forward port 80 on the remote ssh server to a local web server which the client computer would access by going to http://localserver:80/, you would connect with the extra commandline argument -R 80:localserver:80.

Depending on the client computer OS, there will be various other options for setting this up. If you're on any unix-based OS, I would recommend the above, or if you're on Windows, PuTTY is capable of setting up this sort of tunnel (Settings / SSH / Tunnels - select 'Remote' instead of 'Local').

Once the tunnel is set up, that would allow anyone on the same network as the ssh server to connect to the web server on the client network. However, they would not be able to connect to it via its real IP - they would have to connect to http://sshserver:80/ and the traffic would be forwarded to the remote server, and the response returned.

If you wanted to be able to access the same server via the same url, you would need to add a matching DNS entry on the ssh server's network, pointing to the ssh server's IP address. It would not be accessible when the ssh client is disconnected.

Also, note the ssh server only has one port 80, so you could only do this for one remote server at a time. If you want to get around that restriction you would have to assign multiple IPs to the ssh server, and use the optional 'bind address' argument on the ssh command line, or you could spread servers out to different ports (commonly 8080, 8081, ...) by selecting different remote ports in the ssh command - the web servers themselves could still all use port 80.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.