<hr>
<h1 id="scenario">Scenario</h1>
<p>You have three machines:
A: a Macbook laptop connected to the internet
B: an Ubuntu 18.04 server on GCP or AWS used as a pivot server.
Lets call it pivot.example.com, assuming it has a DNS A record.
C: an Ubuntu 18.04 Server at a remote datacenter/office with no inbound rules
configured on the firewall there.</p>
<p>You need to administer server C, from your workstation A, but you're not on the
network of C.</p>
<h1 id="solution-ssh-tunnels">Solution: SSH Tunnels</h1>
<p>SSH can tunnel traffic through a server, effectively proxying the connections.
Here's how this works:</p>
<ul>
<li>C connects to B with a <a href="https://www.howtoforge.com/reverse-ssh-tunneling">reverse tunnel</a>,
so that any connection to port 2022 on B will be proxied to 22 on C.</li>
<li>A connects to B with a reverse tunnel so that any connection to 2022 on A
goes to 2022 on B (which then goes to 22 on C)</li>
<li>Connections from A to 127.0.0.1 on port 22022 act as if they were going to
port 22 on C.</li>
</ul>
<p>This can be done for any TCP service, be it SSH, Web traffic, IPMI, so on.</p>
<h2 id="disclaimer">Disclaimer</h2>
<p>Whoever runs the network you're connecting to might not be happy you did this.
I suggest you talk with them first. It could save you some trouble. There are
security implications to opening a "back door" to a network.</p>
<p>Consider asking for a VPN account to the target network.</p>
<h1 id="commands">Commands</h1>
<p>These examples use the above example port of 2022, but you can forward other
ports and even multiple ports at once as needed.</p>
<h2 id="tunnel-from-target-server-to-pivot-server">Tunnel from target server to pivot server</h2>
<p>From <strong>C</strong>, the remote server,
create the reverse tunnel to <strong>B</strong>, the pivot server.</p>
<pre><code class="language-bash">ssh -fNT -R 2022:localhost:22 ubuntu@pivot.example.com
</code></pre>
<h2 id="tunnel-from-workstation-to-pivot-server">Tunnel from workstation to pivot server</h2>
<p>From <strong>A</strong>, your workstation,
Create a tunnel to <strong>B</strong>, the pivot server, so your own workstation listens
for the traffic.</p>
<p>The sudo is used so you can pick lower ports, if desired. It's optional. The
<code>-i</code> argument is because sudo won't use your regular private key file.</p>
<pre><code class="language-bash">sudo ssh -i ~/.ssh/id_rsa -fNT -L 2022:localhost:2022 ubuntu@pivot.example.com
</code></pre>
<h2 id="connection-from-workstation-to-target-server">Connection from workstation to target server</h2>
<p>Now that you have the two tunnels up, you can connect through them.</p>
<p>On your workstation, SSH through the tunnels:</p>
<pre><code class="language-bash">ssh -p 2022 ubuntu@localhost
</code></pre>
<h1 id="a-neat-trick">A Neat Trick</h1>
<p>In my <a href="x11-forwarding-ubuntu18">x11 forwarding guide</a>, I showed how to open
Chrome on a remote Ubuntu server. You can actually do through through the
tunnels you've just made, allowing you to access internal resources at the
target network.</p>
<pre><code class="language-bash">ssh -XC -c chacha20-poly1305@openssh.com -p 2022 ubuntu@localhost google-chrome
</code></pre>


Kyle Pericak

Port Forwarding through SSH Tunnels