SSH Tunnel Reverse Port forwarding


VPN Tunnel with SSH Port Forwarding

Linux has build in SSH from the start, Apple has also integrated Secure Shell into macOS, Microsoft provide OpenSSH on Windows 10 from 1803 and Server 2019 as an optional feature. There are also SSH Tunnels and SSH port forwarding known from tools like PuTTY and KiTTY. So why use SSH only as Terminal (TTY), as VPN Tunnel there are useful opportunities too, for example, VPN is not able because firewall is not capable, or additional software cannot be installed in corporate networks, because the required authorization is not given. An SSH Reverse Tunnel is always useful for devices they are not reachable behind the firewall.

How to use SSH as a VPN Tunnel with port forwarding use OpenSSH on Linux, macOS and Windows

SSH Tunnel to Remote Host B

Here as an example, a tunnel is built from host A to host B, host B is a web server from which the intranet page is to be opened on Host A. The only requirement is that there is a NAT mapping via port 22 to host B on the firewall (NAT router) and that the SSH service is present on each host.

SSH Tunnel Reverse port forwarding to Remote Host B
Illustration: ssh tunnel host A to host B

Run the command in the Linux terminal on Host A as follows:

On Host A, the web page can now be opened http://localhost. The SSH tunnel enable port forwarding for TCP port 80 on Host B from to the localhost on Host A, the external port is 45680. Just we log on to Host B with user cherry.

The parameters:
-L = Local port
-N = do not run a remote command
-p = External SSH port (NAT port at firewall)
-T = do not open a terminal

On Host B the SSH daemon must be configured and activated, in the configuration file /etc/ssh/sshd_config the following settings are required, for many Linux distributions this is default.

  The lines commented out with hash mean they are default values, e.g. #AllowTcpForwarding is by default yes.

Hint! OpenSSH also available on Synology NAS, FreeNAS, FreePBX Distro, OpenWrt, Raspberry Pi (Raspbian) and now on Windows Servers.

SSH Tunnel to Remote Host C

In this example, an SSH Tunnel is built from Host A to Host C, Host C is an RDS terminal server, Host B serves as a port forwarder.

example, SSH Tunnel Reverse port forwarding built from host A to host C
Illustration: ssh tunnel host A to host C

Run the command in the Linux terminal on Host A as follows:

The Remote Desktop session to Host C is built via localhost on Host A, by pressing the Win + R key opens Run, to confirm the input mstsc /v:localhost with OK.

Run mstsc

  This example uses the tcp port 3389 for RDP as both internal and external port. All unprivileged ports (-L) higher than 1024 can be used, if a port other than 3389 is used, then the port must be passed to RDP for execution, e.g. mstsc /v:localhost:44389

For Host B, the kernel must be enabled for IP forwarding, which is command for this in the shell as root:

Alternatively, echo in the Shell Console does the same thing:

Check the current IPv4 forward status as follows:

The value 1 for activation, 0 applies deactivation. The change is not boot persistent, so that after the next start the IP forwarding is active again, edit using nano or sudo vi /etc/sysctl.conf

It is recommended to use an SSH key for authentication, a key pair can be created as follows:

The public key ~/.ssh/ is stored in the user’s home path, here in this example on Host B under the path in the file .ssh/authorized_keys.

  Authentication using SSH keys is not only more secure, there are other advantages, for example, the user is not asked to enter a password, also the SSH tunnel and other commands can be executed from a script.

SSH Tunnel on macOS

For Apple macOS, SSH is available after activation, open Terminal and run this command as follows:

After that, the SSH Tunnel can be set up under macOS.

Remote Desktop for Mac Gateway on localhost is now registered and the RDP session can be opened, in this way terminal servers are protected and can only be reached via SSH.

macOS also offers the possibility for automation and uses launchd and the launch system services, the following script is created at: @/Library/LaunchDaemons/server.hostc.client.cherry.home.plist with the following content:

OpenSSH Server Installation from PowerShell

For Windows Server 2019, the OpenSSH server can also be deployed from the PowerShell.

  Windows 10 OpenSSH client can be found in the settings, under Apps & Features – Optional Features – OpenSSH Client.

How useful was this post?

Click on a star to rate it!

Average rating 0 / 5. Vote count: 0

No votes so far! Be the first to rate this post.

We are sorry that this post was not useful for you!

Let us improve this post!

Tell us how we can improve this post?

Leave a Reply

Your email address will not be published. Required fields are marked *