Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Practical Guide to SSH Tunnels: Local and Remote Port Forwarding

labs.iximiuz.com

Post reply on HN
Print view View original

71–80 of 83 posts

Re: A Practical Guide to SSH Tunnels: Local and Remote Port Forwarding

#71

Post by Sarky »

saltcured wrote: post #47
hylaride wrote: post #9

Learning how SSH port forwarding is great as a pseudo-vpn for everything from GUI-client database access to (in physical infra) access to web-admin tools for appliances. The socks proxy support can also deal with bad web filtering and privacy issues on public wifi networks (though nowadays if you're ssh'ing to a cloud IP, you'll get lots of "bot" restrictions).

Yeah, I get use out of the SOCKS proxy mode in combination with a "split VPN" at work. I need VPN to get into some internal resources via SSH, but there are lots of external/public/AWS resources I also need to access, and the full VPN adds too much overhead and fragility for those. Using the available split VPN, I can point a browser instance at a localhost SOCKS proxy port to relay over SSH + VPN for other web resou…

Firefox can be used with socks proxies nicely.

- Use Multi-Account Containers plugin, where you define which domain should be opened in which container.

- Use Container Proxy to configure which socks proxy to use for different containers.

Pair that with ssh tunnel that you use as socks proxy and you have nive tunneling solution for browser.

Re: A Practical Guide to SSH Tunnels: Local and Remote Port Forwarding

#72

Post by ale42 »

I think that the start of the article is at least a bit exaggerated:

    SSH is yet another example of an ancient technology that is still in wide use today.
Ancient technology? If it was telnet or FTP... But SSH is much younger than, let's say, IPv4, which is _maybe_ ancient technology still in wide use today.

Re: A Practical Guide to SSH Tunnels: Local and Remote Port Forwarding

#73

Post by hansvs »

smw wrote: post #27

Need to mention sshuttle [0] here, as it magically solves a bunch of these problems without constant reconfiguration [0] https://github.com/sshuttle/sshuttle

Yup, use it regularly in order to jump through networks where a VPN/Wireguard setup is not possible. It can also forward DNS requests and handle local NS operations reasonably well, such that it can be used as a low-key split-VPN client (i.e. only forwards traffic for a specific domain or IP range without redirecting any other traffic). Note that for integration with `systemd-resolved`, one needs to jump through a few hoops, but I feel its works very nicely: https://github.com/sshuttle/sshuttle/issues/688#issuecomment....

Re: A Practical Guide to SSH Tunnels: Local and Remote Port Forwarding

#74

Post by ranger_danger »

bheadmaster wrote: post #68
ranger_danger wrote: post #34

Earlier quoted context omitted.

Do you have more info on this method? How is the remote forwarding actually done?

There's an old blogpost I wrote at the time I came up with this method [0]. I think it contains most of the technical details. Let me know if anything is confusing, I'll answer it here. [0] https://paskozdilar.github.io/blog/entries/zero_code_ssh_jum...

Maybe I'm missing something, but wouldn't the ssh -J option be much easier?

Re: A Practical Guide to SSH Tunnels: Local and Remote Port Forwarding

#75

Post by bheadmaster »

ranger_danger wrote: post #74
bheadmaster wrote: post #68

Earlier quoted context omitted.

There's an old blogpost I wrote at the time I came up with this method [0]. I think it contains most of the technical details. Let me know if anything is confusing, I'll answer it here. [0] https://paskozdilar.github.io/blog/entries/zero_code_ssh_jum...

Maybe I'm missing something, but wouldn't the ssh -J option be much easier?

How do you use -J to connect to a device that isn't publicly reachable?

Re: A Practical Guide to SSH Tunnels: Local and Remote Port Forwarding

#76

Post by saltcured »

Sarky wrote: post #71
saltcured wrote: post #47

Earlier quoted context omitted.

Yeah, I get use out of the SOCKS proxy mode in combination with a "split VPN" at work. I need VPN to get into some internal resources via SSH, but there are lots of external/public/AWS resources I also need to access, and the full VPN adds too much overhead and fragility for those. Using the available split VPN, I can point a browser instance at a localhost SOCKS proxy port to relay over SSH + VPN for other web resou…

Firefox can be used with socks proxies nicely. - Use Multi-Account Containers plugin, where you define which domain should be opened in which container. - Use Container Proxy to configure which socks proxy to use for different containers. Pair that with ssh tunnel that you use as socks proxy and you have nive tunneling solution for browser.

Maybe, but what I want is just a toggle or something in the very basic manual proxy config to invert the current configuration model.

Here's my ad-hoc proxy. Use it for only these domains (while everything else goes direct).

After I complete my special tunneling task, I'm going to flip it back to "no proxy" and resume normal life.

Re: A Practical Guide to SSH Tunnels: Local and Remote Port Forwarding

#77

Post by saltcured »

bheadmaster wrote: post #67
saltcured wrote: post #46

Earlier quoted context omitted.

I think the more modern ProxyJump rule is superior for this. Just let it manage the actual TCP forwarding for you automatically. It's just the normal "bastion host" concept. Particularly, you can use name patterns to apply the same rule broadly, assuming you have some systematic naming scheme for your eventual target devices.

How would you use ProxyJump with Reverse Forwarding?

Oh, I think I misunderstood your description. I just jumped to the conclusion of a bastion host being used via the old proxy command method (what we did before the "jump" feature got added).

But, you're saying all these remote devices individually connect "back" to the central host to keep a tunnel open?

Honestly, I've never had this problem at large scale. When I did have it, I used one of these methods rather than SSH TCP tunneling tricks:

1. I'm in control of the firewall/NAT router itself, deployed OpenWRT, and setup the port-forwarding rules there (i.e. iptables address rewriting).

2. I really need to punch through uncooperative NAT, so I setup OpenVPN with that remote device initiating the persistent tunnel.

Re: A Practical Guide to SSH Tunnels: Local and Remote Port Forwarding

#78

Post by bheadmaster »

saltcured wrote: post #77
bheadmaster wrote: post #67

Earlier quoted context omitted.

How would you use ProxyJump with Reverse Forwarding?

Oh, I think I misunderstood your description. I just jumped to the conclusion of a bastion host being used via the old proxy command method (what we did before the "jump" feature got added). But, you're saying all these remote devices individually connect "back" to the central host to keep a tunnel open? Honestly, I've never had this problem at large scale. When I did have it, I used one of these methods rather than…

In some corporate networks, everything is locked tight, and if you want any access (outbound or inbound), you have to send a request with business justification.

What we had was many devices behind such corporate networks. Instead of requesting exposed ports for each device, or setting up OpenVPN (never done it so I'm not sure how much the red tape would it be), I requested only outbound access to our bastion server's SSH. Since SSH is pretty standard, admins usually allow it fairly quickly.

There were also a few cases where non-HTTPS connections were also banned, so we set up an HTTPS proxy that tunneled the SSH reverse forwarding... But that's probably not needed in most cases.

Re: A Practical Guide to SSH Tunnels: Local and Remote Port Forwarding

#79

Post by pull_my_finger »

Sarky wrote: post #71
saltcured wrote: post #47

Earlier quoted context omitted.

Yeah, I get use out of the SOCKS proxy mode in combination with a "split VPN" at work. I need VPN to get into some internal resources via SSH, but there are lots of external/public/AWS resources I also need to access, and the full VPN adds too much overhead and fragility for those. Using the available split VPN, I can point a browser instance at a localhost SOCKS proxy port to relay over SSH + VPN for other web resou…

Firefox can be used with socks proxies nicely. - Use Multi-Account Containers plugin, where you define which domain should be opened in which container. - Use Container Proxy to configure which socks proxy to use for different containers. Pair that with ssh tunnel that you use as socks proxy and you have nive tunneling solution for browser.

I've been a very happy user of firefox container tabs, but this is the first I'd heard of container proxies. Any resources on them you can share?

Re: A Practical Guide to SSH Tunnels: Local and Remote Port Forwarding

#80

Post by QGQBGdeZREunxLe »

janmatejka wrote: post #70
QGQBGdeZREunxLe wrote: post #58

Earlier quoted context omitted.

A tad hyperbolic for a LAN registry

Not really since all it takes is one person with misconfigured device and your LAN is now accessible from who-knows-where unless the LAN is under very strict lockdown.

The SSL being turned off wouldn't matter in that case.
Post reply on HN