download

Network Services—Internet ServersSSH Tunneling or Port ForwardingA SSH port forwarding tunnel can basically be considered an encrypted VPNconnection that can be used to transfer data over a public network. The benefit ofSSH tunneling is the ease of setup, and the lack of the need for a separate daemon.Hence, you can use your default SSH configuration to establish a secure tunnelto your server, or the network behind your server. Using SSH tunneling, youcan transmit almost any protocol that uses TCP as transmission protocol over anencrypted SSH tunnel.A SSH tunnel can be established in two modes—Dynamic forwarding andStatic forwarding.Dynamic forwarding is, in fact, turning your host into a SOCKS 4/5 proxy serverand forwarding all network traffic from the proxy server to the destination host overa secure tunnel. This can be used to connect to a remote network through a firewall,like a VPN client into a private network.The following example shows an example of SSH connection to a remote host withdynamic port forwarding:# ssh –D 4567 –l babak 172.16.25.1This example establishes an SSH connection to the host 172.16.25.1 with username"babak". It also listens on TCP port 4567 on localhost, and acts as a SOCKS proxyserver and forwards traffic to the destination host over the secure connection.Now you should configure your application (for example web browser) to use yourSOCKS proxy on the localhost port 4567. Please note that you can use any otherunused port number on your host for the proxy server to listen on.This method can also be used to get through restrictive firewalls and access publicinternet without restrictions, by tunneling traffic over a secure SSH tunnel to anexternal host that runs the SSH server.Static port forwarding offers much simpler methods compared to dynamic portforwarding for simple scenarios in which you want to forward traffic to one specificapplication on another host. An example is forwarding traffic from your host to yourremote SMTP server, over a secure SSH tunnel.In this example, SSH listens to the port 4425 on local host and forwards anyconnection on this port to host the mail.example.org port TCP 25 via secure SSHtunnel that is established to remote SSH server on 172.16.25.1 as shown here:# ssh –L 4425:mail.example.org:25 172.16.25.1[ 212 ]