Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Practical Guide to SSH Tunnels: Local and Remote Port Forwarding

labs.iximiuz.com

Post reply on HN
Print view View original

51–60 of 83 posts

Re: A Practical Guide to SSH Tunnels: Local and Remote Port Forwarding

#51

Post by tangotaylor »

mmh0000 wrote: post #40
tangotaylor wrote: post #33

My favorite use of this is peer-to-peer transfer of Docker images. The Docker CLI only allows you to use registries authenticated with HTTPS but there's an exception where it allows HTTP transfers over localhost. So, if you use SSH tunneling to forward a port from localhost to a remote, then Docker unwittingly pushes to a remote. This is super useful "off the grid" with robotics/embedded applications where you don't…

That's not quite true, you just need to add the `insecure-registries`[1] option with a list of either IP (or ip ranges) or hostnames that you want to allow without TLS. ```/etc/docker/daemon.json { "insecure-registries": ["10.100.0.0/24", "registry.yourmom.example.com:5000"] } ``` [1] https://docs.docker.com/reference/cli/dockerd/#insecure-regi...

Yes this is true. I should caveat that we distributed the tool among a team and we didn't want to ask them to all edit their daemon.json with an ever-expanding list of IP addresses.

Re: A Practical Guide to SSH Tunnels: Local and Remote Port Forwarding

#52

Post by hylaride »

saltcured wrote: post #47
hylaride wrote: post #9

Learning how SSH port forwarding is great as a pseudo-vpn for everything from GUI-client database access to (in physical infra) access to web-admin tools for appliances. The socks proxy support can also deal with bad web filtering and privacy issues on public wifi networks (though nowadays if you're ssh'ing to a cloud IP, you'll get lots of "bot" restrictions).

Yeah, I get use out of the SOCKS proxy mode in combination with a "split VPN" at work. I need VPN to get into some internal resources via SSH, but there are lots of external/public/AWS resources I also need to access, and the full VPN adds too much overhead and fragility for those. Using the available split VPN, I can point a browser instance at a localhost SOCKS proxy port to relay over SSH + VPN for other web resou…

In the past, I've used plugins to do just what you ask. FoxyProxy Standard did the trick (it looks like there's now at least another more standard "VPN" version, too). It looks like Firefox does have support for Native PAC files that'll also do the trick: https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Pro...

Re: A Practical Guide to SSH Tunnels: Local and Remote Port Forwarding

#53

Post by 05 »

chasil wrote: post #4

The article mentions bastions, but no jumphosting? ssh -J user1@bastion1,user2@bastion2 targetuser@targethost Edit: Jumphosting was introduced in OpenSSH 7.3 2016-08-01. https://www.openssh.org/releasenotes.html

And with match/exec rules you can always connect to MyHost and make it conditional whether to use a jumphost or not, so it's like an on demand vpn.. only with ssh.

    Match host="MyHost" exec "! grep Home ~/.wifi-loc-control/.current"
    ProxyJump home-jumphost.mydomain.tld

Re: A Practical Guide to SSH Tunnels: Local and Remote Port Forwarding

#54

Post by TacticalCoder »

hylaride wrote: post #9

Learning how SSH port forwarding is great as a pseudo-vpn for everything from GUI-client database access to (in physical infra) access to web-admin tools for appliances. The socks proxy support can also deal with bad web filtering and privacy issues on public wifi networks (though nowadays if you're ssh'ing to a cloud IP, you'll get lots of "bot" restrictions).

> The socks proxy support ...

I just love SOCKS proxy in SSH tunnels: at some point I had a dedicated server (on a fixed IP) with countless machines (usually headless Pis dropped at a family member's place and/or SME office) automatically setting up, 24/7, reverse tunnels to that dedicated server.

Then I could, from anywhere, both access their LANs (to fix stuff) and have a browser, running locally, pretending to be in this or that country.

Basically because I had all those reverse tunnels always there, I could always decide how to use them (just SSH in or SOCKS in etc.).

Re: A Practical Guide to SSH Tunnels: Local and Remote Port Forwarding

#55

Post by nekusar »

BTW I use this and a systemd unit file and SSH tunnel my Jellyfin to a public VPS to its local host.

I then use nginx to proxy it.

Because its a unit file, sshd reconnects if my ISP's IP changes. Does so within 30s. Also hides my ISP IP in case I have to turn it off.

And no data is effectively on the VPS. Its just a mostly empty machine.

Re: A Practical Guide to SSH Tunnels: Local and Remote Port Forwarding

#57

Post by trentnelson »

ptaffs wrote: post #29
telotortium wrote: post #16

Earlier quoted context omitted.

Important to note that `~` SSH commands work only right after you press Enter - it doesn’t trigger everywhere you press `~`. Also EnableEscapeCommandline fortunately only affects `~C` - the all-important `~.` to kill a hung SSH session still works with it disabled.

so many time i have inadvertently ended a session with a fat fingered ~.

Not ssh related but I regularly suspend my terminal with Ctrl-S by accident, usually when going for Ctrl-C/V.

That was a nightmare to triage back in the late 90s when I did it. Thankfully Ctrl-Q (I think it’s Q) “resumes”, so, easy fix if you know what you’ve done.

Re: A Practical Guide to SSH Tunnels: Local and Remote Port Forwarding

#58

Post by QGQBGdeZREunxLe »

bitlad wrote: post #39
QGQBGdeZREunxLe wrote: post #37

Earlier quoted context omitted.

This is really useful as you don't have to add an entry under insecure-registries for local registries that don't have valid certificates.

You might as well handover the images to hackers.

A tad hyperbolic for a LAN registry

Re: A Practical Guide to SSH Tunnels: Local and Remote Port Forwarding

#59

Post by fragmede »

tangotaylor wrote: post #51
mmh0000 wrote: post #40

Earlier quoted context omitted.

That's not quite true, you just need to add the `insecure-registries`[1] option with a list of either IP (or ip ranges) or hostnames that you want to allow without TLS. ```/etc/docker/daemon.json { "insecure-registries": ["10.100.0.0/24", "registry.yourmom.example.com:5000"] } ``` [1] https://docs.docker.com/reference/cli/dockerd/#insecure-regi...

Yes this is true. I should caveat that we distributed the tool among a team and we didn't want to ask them to all edit their daemon.json with an ever-expanding list of IP addresses.

Could the tool you distributed update the daemon.json for your users so they don't have to change daemon.json manually?

Re: A Practical Guide to SSH Tunnels: Local and Remote Port Forwarding

#60

Post by idatum »

chasil wrote: post #4

The article mentions bastions, but no jumphosting? ssh -J user1@bastion1,user2@bastion2 targetuser@targethost Edit: Jumphosting was introduced in OpenSSH 7.3 2016-08-01. https://www.openssh.org/releasenotes.html

What I've found beautiful about -J is the host you jump through requires no privileges on the final host. Only my laptop has the SSH key to access my home server, not my cheap VPS.

And this allows me to have zero open ports on my home internet. I do a reverse tunnel to my VPS from my home server (in a FreeBSD jail), and that port is what my laptop client jumps through.

Post reply on HN