SSH Port Forward

| No Comments | No TrackBacks


   ssh -qTfnN -L port:host:hostport -l user remote_ip


ssh -qTfnN -R port:host:hostport -l user remote_ip


SSH -qTfnN -D port remotehost(用证书验证就直接主机名,没用的还要加上用户名密码)

-q Quiet mode. 安静模式,忽略一切对话和错误提示。
-T Disable pseudo-tty allocation. 不占用 shell 了。
-f Requests ssh to go to background just before command execution. 后台运行,并推荐加上 -n 参数。
-n Redirects stdin from /dev/null (actually, prevents reading from stdin). -f 推荐的,不加这条参数应该也行。
-N Do not execute a remote command. 不执行远程命令,专为端口转发度身打造。


There are two kinds of port forwarding: local and remote forwarding. They are also called outgoing and incoming tunnels, respectively. Local port forwarding forwards traffic coming to a local port to a specified remote port.

For example, if you issue the command

ssh2 -L 1234:localhost:23 username@host

all traffic coming to port 1234 on the client will be forwarded to port 23 on the server (host). Note that localhost will be resolved by the sshdserver after the connection is established. In this case localhost therefore refers to the server (host) itself.

Remote port forwarding does the opposite: it forwards traffic coming to a remote port to a specified local port.

For example, if you issue the command

ssh2 -R 1234:localhost:23 username@host

all traffic which comes to port 1234 on the server (host) will be forwarded to port 23 on the client (localhost).

It is important to realize that if you have three hosts, client, sshdserver, and appserver, and you forward the traffic coming to the client's port x to the appserver's port y, only the connection between the client and sshdserver will be secured. See Figure Forwarding to a third host. The command you use would be something like the following:
ssh2 -L x:appserver:y username@sshdserver

Remote Port Forwarding
This is useful to tunnel things like RDP (Remote Desktop) through an encrypted SSH tunnel over the internet. For example, you want to be able to access your work computer from home.

If you had:

HomePC <-> Router <-> Internet <-> Firewall <-> WorkPC

WorkPC, which is running RDP on port 3389, issues ssh -R 5555:localhost:3389 root@router.home

HomePC can use his RDP client to connect to port 5555 on the router and this would create an SSH tunnel which will connect HomePC to port 3389 on the WorkPC



在WorkPC 执行  ssh -R 5555:localhost:3389 root@router.home

这样 localhost会解析为WorkPC



No TrackBacks

TrackBack URL:

Leave a comment


May 2016

Sun Mon Tue Wed Thu Fri Sat
1 2 3 4 5 6 7
8 9 10 11 12 13 14
15 16 17 18 19 20 21
22 23 24 25 26 27 28
29 30 31        

About this Entry

This page contains a single entry by 谷多 published on December 29, 2009 12:30 AM.

SSH And Port Forwarding was the previous entry in this blog.

最近入手的数码小玩意 is the next entry in this blog.

Find recent content on the main index or look in the archives to find all content.