↓Skip to main content
  1. Posts/

SSH Tunnel Port Forwarding

·282 words·2 mins
Networking Linux
An underground MRT station concourse in Singapore with ticket gates, a directional sign pointing to Resorts World Sentosa, and a pedestrian.
Singapore MRT station concourse near Sentosa. Photo © Aidil Putra, August 2023.
Table of Contents

Overview #

SSH tunnel port forwarding allows you to securely route network traffic through an SSH connection. This is extremely useful when:

  • A target network has no gateway
  • Devices are only reachable from another Linux host

SSH supports three major tunneling modes:

  • Local port forwarding (-L)
  • Remote port forwarding (-R)
  • Dynamic port forwarding / SOCKS proxy (-D)

This guide focuses on Dynamic Port Forwarding (SOCKS proxy) with practical examples.

Run SSH Proxy #

From your local machine, run in background:

ssh -f -N -D 1080 user@linux-host

Explanation:

  • -D 1080 → Open SOCKS5 proxy on localhost:1080
  • -f → Run in background
  • -N → No remote command execution

Once connected, your local machine has a SOCKS proxy at:

127.0.0.1:1080

Using SSH Proxy #

Access internal devices using a browser #

  • Configure the browser using a SOCKS proxy (Browser → Settings):
- Proxy Type: SOCKS
- SOCKS Version: SOCKS5
- Host: 127.0.0.1
- Port: 1080
- Enable: Proxy DNS through SOCKS
  • Access Device
http://<device-ip>
https://<device-ip>

Access internal devices using SSH SOCKS proxy #

SSH into another host behind Linux:

ssh -o "ProxyCommand=nc -x 127.0.0.1:1080 %h %p" user@internal-host

This allows chaining access without exposing routes.

Perform APT using SSH SOCKS proxy #

  • Temporary configuration using single command
sudo apt -o Acquire::http::Proxy="socks5h://127.0.0.1:1080" update
  • Persistent configuration by adding a new apt.conf.d file

Create file:

sudo vim /etc/apt/apt.conf.d/99socks

Content:

Acquire::http::Proxy "socks5h://127.0.0.1:1080";
Acquire::https::Proxy "socks5h://127.0.0.1:1080";

Perform DNF using SSH SOCKS proxy #

  • Modify file /etc/dnf/dnf.conf
vim /etc/dnf/dnf.conf
  • Add this configuration at the bottom of dnf.conf
proxy=socks5h://localhost:1080
  • Test dnf command
sudo -E dnf install curl

Conclusion #

SSH tunnel port forwarding is a powerful, secure, and reversible solution for accessing isolated networks. It avoids permanent routing changes while giving full Layer-7 access through a trusted Linux host.