2

I am experimenting a bit with ssh port forwarding and I stumbled upon a confusing thing. It seems to me that the following commands are doing the same thing:

ssh -NfL 192.168.121.215:2222:vm2.local:22 vm2.local
ssh -NfL 192.168.121.215:2223:localhost:22 vm2.local
ssh -NfL 192.168.121.215:2224:vm2.local:22 localhost

Connecting to pots 2222, 2223 and 2224 from pc brings me all to vm2.local.

$ ss -antp # on vm1.local (192.168.121.215)
State      Recv-Q Send-Q        Local Address:Port          Peer Address:Port 
LISTEN     0      128         192.168.121.215:2222                     *:*      users:(("ssh",10170,4))
LISTEN     0      128         192.168.121.215:2223                     *:*      users:(("ssh",10178,4))
LISTEN     0      128         192.168.121.215:2224                     *:*      users:(("ssh",10225,4))
LISTEN     0      128                       *:22                       *:*      users:(("sshd",836,3))
...

What is the difference between the above commands? Is the tunnel created somewhat different? The first command is correct according to man pages, the second is from some website and the last is error I made that turned out working too.

Improve this question
5
  • Are vm2.local and localhost the same machine?
    – cutrightjm
    Dec 5, 2015 at 3:30
  • Have you tried directly using the IP address instead of the hostname? @ekaj may be right.
    – Aloha
    Dec 5, 2015 at 6:54
  • vm2.local and localhost being the same, those are indeed, the same exact command, you'll connect local port 2222 to 2224 to 22 on localhost.
    – Archemar
    Dec 5, 2015 at 8:46
  • see my more complete answer on port forwarding : unix.stackexchange.com/questions/237904/…
    – Archemar
    Dec 5, 2015 at 8:47
  • @ekaj The vm1.local and vm2.local are virtual machines on the 192.168.121.0/24 network. HOST: 192.168.121.1, vm1.local: 192.168.1.215, vm2.local 192.168.1.161.
    – NefariousOctopus
    Dec 5, 2015 at 10:52

1 Answer 1

Reset to default
2

There IS difference, even though it does not matter in your case. I am not good in drawing, so I will try to describe it with words:

  1. ssh -NfL 192.168.121.215:2222:vm2.local:22 vm2.local

    This makes encrypted connection between your host and vm2.local and the port is forwarded through this secure channel, because every end (local and remote) binds its local IP address.

  2. ssh -NfL 192.168.121.215:2223:localhost:22 vm2.local

    This is the same like above, but you don't bind address of public network interface, but the local one (127.0.0.1). For ssh port, there is no difference (it listens on both of them), but it matters for services listening only on localhost (for example mysql).

  3. ssh -NfL 192.168.121.215:2224:vm2.local:22 localhost

    This one is connecting to your local host securely (basically no security effect) and then binds remote host directly, so everything you write to the port 2224 is send directly between the machines unencrypted (no problem here for SSH connections, but it would matter for different type of traffic).

Conclusion

You should learn to use the second case, but when the forwarded port is not needed to be accessible from outside, you should always bind localhost on local side, like this:

ssh -NfL localhost:2223:localhost:22 vm2.local

where the localhost is default, so you can boil it down to 

ssh -NfL 2223:localhost:22 vm2.local
Improve this answer
3
  • So if I get it right it means ssh -NfL <to_what_addres_to_bind_on_local_machine>:<local_machine_port>:<to_what_addres_to_bind_on_remote_machine>:<remote_machine_port> <remote_machine>.
    – NefariousOctopus
    Dec 5, 2015 at 11:00
  • exactly. This is also in manual page, but in more complicated way.
    – Jakuje
    Dec 5, 2015 at 11:01
  • Now whole universe makes sense again! :) Thank you :)
    – NefariousOctopus
    Dec 5, 2015 at 11:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .