Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A visual guide to SSH tunnels

robotmoon.com

Post reply on HN
Print view View original

51–60 of 82 posts

Re: A visual guide to SSH tunnels

#51

Post by px43 »

There's a really fancy new -R feature that I love (added in 2017 I think).

ssh -R

This opens up a localhost port on the target that acts as a socks server which tunnels all your traffic through the source machine.

This is great for machines that you can SSH into, but are otherwise completely isolated from the network, or are monitored heavily. You can jump on, and pull down everything you need from the existing SSH connection, rather than using the machine to make requests out to the internet directly.

This is also good if the source machine is a web server or something on a secured network which can SSH out, but not much else, and the destination is your command and control server on the internet. Then it opens up a socks port on the C&C machine that gives full access to the internal network, impersonating the source machine.

Every other -R is a point to point TCP connection, but setting up a SOCKS proxy with -R is magic. More analogous to a reverse -D than a reverse -L. Super useful.

Re: A visual guide to SSH tunnels

#52

Post by giuseppeciuni »

dloss wrote: post #9

Drawing some diagrams helped me understand remote port forwarding and OpenSSH's port:host:port syntax: http://dirk-loss.de/ssh-port-forwarding.htm

Thanks! I pinned your page on my evernote.. I always get confuse everytime I need to make a ssh port forward. After a while I get it but I spend time (and some bad words :P)

Re: A visual guide to SSH tunnels

#53

Post by rzzzt »

comradesmith wrote: post #48
nerdponx wrote: post #44

Earlier quoted context omitted.

Is ~ a literal ~ character? Or notation for some modifier key? I only knew about ^ to mean "control".

Literal ~. Its input as a sequencenot as a modifier. Iirc the sequence ~h or ~? prints a little help page

Warning, if you read comradesmith's comment even more literally and type "~." (tilde and period) in an SSH session, that will close the connection and exit the client. It is useful when a remote application hangs and does not let you exit gracefully: https://apple.stackexchange.com/questions/35524/what-can-i-d...

Re: A visual guide to SSH tunnels

#55

Post by throw0101a »

xioxox wrote: post #14
lxgr wrote: post #12

Earlier quoted context omitted.

SSH isn’t a replacement for VPNs. I’d argue that they complement each other. For example, SSH port forwarding is TCP only, so if you need UDP, you‘ll need a VPN.

[note I am wrong here - it doesn't support UDP - see below] The ssh SOCKS proxy supports UDP. I use Firefox with a SOCKS proxy via ssh (e.g. ssh -D 2222 hostname) to get around geoblocking and accessing papers via an institutional account. The tsocks program can also let you use a SOCKS proxy for an arbitrary command in linux. I find it much more convenient than a VPN, as it can be easily applied to single programs.

Note that the default port for SOCKS(5) is 1080, and the de facto standard for (forward) web proxies (e.g., Squid) is 3128, so one may want to make of habit of using one of those ports.

Re: A visual guide to SSH tunnels

#57

Post by fooblat »

fooblat wrote: post #26

Great write up! One thing to add is that you can even open tunnels during an interactive session without disconnection. To do this, type the escape command sequence ~C (will not show) and it will drop you to the control prompt. You can then add tunnels. ssh> ssh> -L 8000:localhost:9000 Forwarding port.

Since this tip is popular I'll share another related tip.

When using nested ssh session, you can send escape commands to any of them by the number of tildes. For example, if you ssh into Server A and then from Server A to Server B:

    ~~.   # drop session from Server A to Server B
    ~.    # drop original session into Server A

Re: A visual guide to SSH tunnels

#58

Post by milofeynman »

nafizh wrote: post #54

In tmux, when opening multiple sessions to the same remote server, how do you avoid typing the password repeatedly?

Add your ssh pub key (id_rsa.pub) to authorized_ssh keys on the remote servers will automatically authenticate you.

https://www.ssh.com/ssh/copy-id

Re: A visual guide to SSH tunnels

#59

Post by kps »

nafizh wrote: post #54

In tmux, when opening multiple sessions to the same remote server, how do you avoid typing the password repeatedly?

Look up ‘shh multiplexing’. This makes subsequent sessions share the same connection. I don't know a particularly good tutorial; maybe see https://en.wikibooks.org/wiki/OpenSSH/Cookbook/Multiplexing

Re: A visual guide to SSH tunnels

#60

Post by lxgr »

beermonster wrote: post #43
lxgr wrote: post #12

Earlier quoted context omitted.

SSH isn’t a replacement for VPNs. I’d argue that they complement each other. For example, SSH port forwarding is TCP only, so if you need UDP, you‘ll need a VPN.

Actually, OpenSSH has built-in TUN/TAP support using -w : . You can create a layer 3/point-to-point/ TUN tunnel or layer 2/ethernet/TAP tunnel. I used to run a site-to-site VPN between two sites a couple of decades ago with a simple script doing just this. These days we'd use OpenVPN or strongSwan for such use-cases but despite the 'hackiness' of the former approach, it worked reliably for years.

OpenSSH VPNs suffer from TCP-over-TCP [1]. I'd only use them as a last resort.

Sometimes I actually wish SSH would offer UDP support for precisely this use case, but arguably, TCP VPN support is already a stretch in terms of scope for SSH.

[1] http://sites.inka.de/sites/bigred/devel/tcp-tcp.html

Post reply on HN