Ssh – What does port forwarding mean in “SSH port forwarding”

port-forwardingssh

  1. Wikipedia says

    In computer networking, port forwarding or port mapping is an application of network address translation (NAT) that redirects a
    communication request from one address and port number combination
    to another while the packets are traversing a network gateway, such
    as a router or firewall.

    Does the definition of port forwarding apply to "SSH port
    forwarding"?

    What does "port forwarding" mean in SSH local and remote port
    forwarding?

  2. In particular what is forwarded to what by
    what?

    For example. In https://askubuntu.com/a/50075/1471,

    The command for forwarding port 80 from your local machine (localhost) to the remote host on port 8000 is ssh -R
    8000:localhost:80 oli@remote-machine.

    Would you say the same thing, or will you say "forwarding port 8000
    on the remote host to port 80 on local machine"?

Best Answer

1 - general case

Suppose you have two server in a company network.

From local server "L1" you have access to a remote server "R1" via ssh on port 22.

  1. The server R1 host a web service, but firewall/NAT/whatever block direct access to port 80.

  2. "R1" can't access "L1" directly due to NAT issue.

from L1 you connect using (same user on both host)

ssh -L 10080:localhost:80 -R 10022:localhost:22 R1

now,

  • -L 10080:localhost:80 local browsing on 10080 will be forward to distant host (R1), localhost (e.g. distant 127.0.0.1) on port 80, thus you could browse distant host (R1), while blocked by firewall/NAT.

  • -R 10022:localhost:22 remote use of port 10022 will be forwarded to localhost (L1) port 22, you can initiate scp/ssh from remote to localhost. (using scp -P 10022 file localhost: (note upper -P ) )

This is actually a command line I use from an Ubuntu (14.04) laptop to go to production server (I can firefox to localhost:10080 and use scp from server to localhost:10022 to bring back file )

now your IP are

192.168.1.1 L1
172.17.17.1 R1

you use

ssh -L 10080:172.17.17.3:80 -R 10022:192.168.1.5:22 \
     -L 192.168.1.9:8888:172.17.17.9:9999 R1

now

  • distant access to port 10022 (any IP) will be forwarded to local 192.168.1.5 ssh/scp.
  • local access to port 10080 (any IP) will be forwarded to distant host 172.17.17.3 port 80.
  • local access to port 8888 from 192.168.1.9 will be forwarded to port 9999 on 172.17.17.9 (192.168.1.9 is a local address in L1, using alias mecanism, this is not a firewall rule).

those setting can be used on putty/bitwise client Port forwarding on putty

Ask Ubuntu question

what about 

 -R 8000:localhost:80

this read as

  • -R remote
  • 8000 port 8000 (remote port 8000 ... )
  • localhost (remote port 8000 goest to localhost .. )
  • 80 ( remote port 8000 goes to localhost port 80 )
Related Question