Ssh tunneling how does it work

So a connection road for cars is being tunneled through another connection naval route of the ferry. We have to first define what the direction of a tunnel means. Say port A wants to have a ferry line with port B.

This is a normal tunnel. So the ferry you board in port B is the only way to access port A. If you are offsite and need to access a resource that is protected in this way, you can use ssh to tunnel through an accessible resource to reach the protected resource. We generally recommend using the host "tunnel. For more detailed information, please read more about the "-L" parameter at the SSH man page. The above example uses option "-N" do not execute remote command to create a noninteractive ssh connection and option "-f" to request ssh to go to the background once the ssh connection has been established.

Concordia University uses technical, analytical, marketing and preference cookies. For example, they may forward a port on their local machine to the corporate intranet web server, to an internal mail server's IMAP port, to a local file server's and ports, to a printer, to a version control repository, or to almost any other system on the internal network. Frequently, the port is tunneled to an SSH port on an internal machine.

This example opens a connection to the gw. By default, anyone even on different machines can connect to the specified port on the SSH client machine. However, this can be restricted to programs on the same host by supplying a bind address :. The LocalForward option in the OpenSSH client configuration file can be used to configure forwarding without having to specify it on command line. For example:. This allows anyone on the remote server to connect to TCP port on the remote server.

The connection will then be tunneled back to the client host, and the client then makes a TCP connection to port 80 on localhost.

Any other host name or IP address could be used instead of localhost to specify the host to connect to. This particular example would be useful for giving someone on the outside access to an internal web server. Or exposing an internal web application to the public Internet.

This could be done by an employee working from home, or by an attacker. By default, OpenSSH only allows connecting to remote forwarded ports from the server host. It can be used to add encryption to legacy applications.

SSH is a standard for secure remote logins and file transfers over untrusted networks. This means that the application data traffic is directed to flow inside an encrypted SSH connection so that it cannot be eavesdropped or intercepted while it is in transit.

SSH tunneling enables adding network security to legacy applications that do not natively support encryption. The figure presents a simplified overview of SSH tunneling. This SSH connection is encrypted, protects confidentiality and integrity, and authenticates communicating parties.

The SSH connection is used by the application to connect to the application server. With tunneling enabled, the application contacts to a port on the local host that the SSH client listens on. The SSH client then forwards the application over its encrypted tunnel to the server. The server then connects to the actual application server - usually on the same machine or in the same data center as the SSH server. The application communication is thus secured, without having to modify the application or end user workflows.

The downside is that any user who is able to log into a server can enable port forwarding. This is widely exploited by internal IT people to log into their home machines or servers in a cloud, forwarding a port from the server back into the enterprise intranet to their work machine or suitable server. Hackers and malware can similarly use it to leave a backdoor into the internal network.