We have a cluster (currently 10 machines) behind a NAT. There is a NAT gateway/jump-host between the private network and the regular company network.

Users can ssh to the jump-host and then get into any other machine behind the NAT.

I would like to provide an easy script which helps them to tunnel web interfaces behind the NAT to their local machines.

So my first suggestions was: using a SSH socks proxy and tunnel the interfaces to their localhost.

So my question is: If I create these two tunnels (one from the local computer of my co-workers to the jump-host, and the one from the jump-host to the corresponding machine behind the NAT) - how secure is this tunnel?

Imagine worker1 which is doing this:

ssh -t [email protected] -L 10001:localhost:33388 ssh -t hostxyz.behindnat.tld

There is an open port 33388 on the jump-host machine which is listening on the loopback interface. If worker2 just logs into the jump-host and uses the localhost port 33388 as well for the already tunneled connection, he must not authenticate again to the hostxyz.behindnat.tld, right?

This seems like a huge security flaw to me, is there a better solution?

  • Use vpn instead. Jumping over hosts with ssh is not too effective or comfortable. Nov 21, 2017 at 13:23
  • This always seemd like an overkill for just one port which has to exposed to the users. Its quite charming to put this command into a bash / batch and let the users just authenticate and than use the interface that easy. If using a vpn I have to take care of routing and stuff :-S
    – Smoki
    Nov 21, 2017 at 13:30

1 Answer 1


I assume your scenario implies a preexisting ssh session between jumphost and hostxyz, which would be open to all with access to jumphost’s listening port.

You mentioned socks and tunnel, which are technically two different things.

Setup worker1’s socks proxy like this: ssh [email protected] -D

Set worker1’s browser to use socks localhost:10001 to browse via jumphost.tld

If you want to ssh directly from worker1 to hostxyz, you could do something like the following.

  ssh [email protected] -L localhost:10001:hostxyz:22
  ssh user@localhost:10001

This is what I do. I use an .ssh/config file to keep everything organized. I recommend reading the following for info on the config file and tunneling. https://man.openbsd.org/ssh_config Watch Michael W Lucas talk on openssh for an other good primer.

  • Ahh okay, but exactly this seems a little insecure to me: Lets assume a authentication has to be done at host "hostxyz" - YOU will be prompted for an authentication, but if another worker can login into the jumphost, he can use your opend port 10001 to get a already authenticated connection to hosxyz, right?
    – Smoki
    Nov 22, 2017 at 12:55
  • In my example, 10001 is listening on worker1’s loopback address (, not the jumphost. Anyone logged in to worker1’s computer can reach that address. But not everyone logged into the jumphost. Nov 25, 2017 at 15:16
  • When you say authentication, are you talking about ssh to hostxyz or web auth or something else? Nov 25, 2017 at 15:18
  • Run the commands I mentioned on worker1's machine and run netstat -an | grep LISTEN on each machine and you'll see where the listening ports are. Nov 27, 2017 at 16:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .