SSH Tunneling: The Swiss Army Knife

SSH is often used just to get a terminal on a remote server. But for a senior administrator, SSH is a Wormhole. It allows you to transport network traffic from one place to another through a single, encrypted connection.

Have you ever needed to access a database that is blocked by a firewall? Or wanted to show a website running on your laptop to a client in another city? Or wanted to browse the web safely on public Wi-Fi?

SSH Tunneling is the answer to all of these.

2. Local Port Forwarding: Accessing the Forbidden

Imagine there is a MySQL database in a private cloud. You can't reach it directly from your home. But you can SSH into a "Bastion" server that can see the database.

Local PC --(SSH)--> Bastion --(Internal)--> Database

ssh -L 3306:database-private-ip:3306 user@bastion-ip

What this does:

It opens Port 3306 on your local laptop.
When you connect to localhost:3306, SSH "Tunnels" that data to the Bastion.
The Bastion "Unwraps" it and sends it to the private Database.

3. Remote Port Forwarding: Sharing your Local Port

This is the opposite. Suppose you are developing a web app on your laptop (localhost:8000). You want a coworker to see it, but you don't have a public IP.

ssh -R 8080:localhost:8000 user@public-server-ip

What this does:

It opens Port 8080 on the remote server.
When anyone visits public-server:8080, their traffic is tunneled BACK to your laptop's Port 8000.

4. Dynamic Port Forwarding: Your Personal VPN

This is the most powerful method. It creates a SOCKS Proxy.

ssh -D 9000 user@remote-server

How to use it: Go to your Web Browser settings and set the SOCKS Proxy to localhost:9000. Now, every website you visit will think you are the remote server. Your ISP and the coffee shop owner won't see anything except an encrypted SSH stream.

5. Practical: Breaking Out of Firewalls

If an office firewall blocks specific ports (like Slack or Discord), but allows SSH, you can use a tunnel to "Escape."

graph LR
    User[User Laptop] -- Encrypted Tunnel --- Firewall[Strict Office Firewall]
    Firewall --- Proxy[Public SSH Server]
    Proxy --- Web[The Internet]

6. Security: The 'GatewayPorts' Warning

By default, an SSH tunnel is only accessible from the machine that created it. If you want other people on your local network to use your tunnel, you must enable GatewayPorts yes in your sshd_config.

WARNING: Be careful! This can accidentally expose your internal office resources to your entire local subnet.

7. Example: A Tunnel Health Checker (Python)

If you are using a tunnel for a critical backup, you need to know if the tunnel "Hangs" or disconnects. Here is a Python script that tests if a local port has a healthy SSH tunnel behind it.

import socket
import time

def check_tunnel(port=3306):
    """
    Attempts to connect to a local port to verify a tunnel.
    """
    print(f"Checking Tunnel on Port {port}...")
    
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.settimeout(2)
    
    try:
        # We try to connect to localhost
        result = s.connect_ex(('127.0.0.1', port))
        if result == 0:
            print(f"[OK] Tunnel is active on Port {port}.")
        else:
            print(f"[!!!] ALERT: Tunnel is CLOSED on Port {port}!")
    except Exception as e:
        print(f"Error checking tunnel: {e}")
    finally:
        s.close()

if __name__ == "__main__":
    check_tunnel(3306)

8. Summary

SSH Tunneling turns a simple connection into a network bridge.

-L (Local) for bringing remote resources home.
-R (Remote) for exposing local resources to the world.
-D (Dynamic) for a personal, encrypted proxy.
-N (No command) is often used with tunnels so you don't open an actual terminal.

In the final lesson of this module, we will learn how to audit your entire system's security using Lynis and Vulnerability Scanning.

Quiz Questions

Why would you use a "Dynamic" port forward (-D) instead of a "Local" port forward (-L)?
What is a "Bastion Host" (or Jump Box) in the context of SSH tunneling?
How can you ensure an SSH tunnel stays alive even if the network is unstable? (Hint: autossh).

Continue to Lesson 6: Security Auditing—Lynis and Vulnerability Scanning.

The Swiss Army Knife: SSH Tunneling