ssh port forwarding with custom host name

Question

I often do port forwarding to access remote web servers with this command:

ssh user@remotehost -L 1234:localhost:1234

So now I can enter http://localhost:1234 in my browser to access the remote host's web server. What I want to do now is use a name other than localhost. For example, is it possible to invoke ssh with some argument such that I can enter http://remotealias:1234 in my browser to access the remote web server? This is particularly useful when I'm running other services in my local machine on port 1234 at the same time (and don't want to remember many port:host tunnel mappings).

If it's not possible with the ssh command alone, I'm also interested in solutions that require editing some local configuration in my machine to make it work as described.

Answer 1

Yes; You could make an IP per host on your local box

ip address add 122.0.0.2/32 dev eth0
ip address add 122.0.0.3/32 dev eth0

and edit your hosts file

echo "127.0.0.2 remotehost1.com" >> /etc/hosts
echo "127.0.0.3 remotehost2.com" >> /etc/hosts

then forward each IP to the hosts IP (direct access via domain would be broken by the hosts file change)

ssh user@$remotehost1_IP -L 127.0.0.2:80:localhost:1234
ssh user@$remotehost2_IP -L 127.0.0.3:80:localhost:1234

then use your web browser like normal

http://remotehost1.com
http://remotehost2.com

This will tunnel each remote fqdn through its own ssh tunnel, on it's own local ip.

Answer 2

When you establish port forwarding by ssh - you setup a bridge between port on your_machine:port (perspective of your machine) to machine:port from perspective of the machine you've made a connection to.

In other words - if you invoke command

ssh user@remotehost -L 1234:localhost:4567

you make an ssh connection to remotehost plus if you connect to port 1234 on your machine (localhost address for you) remote part of your ssh connection will try to make connection to localhost (to itself - as localhost on remotehost will point to itself) on port 4567

Back to the meritum of question.

If you have other services on port 1234 on your machine, you can instead select another port that is free on your machine.

Answer 3

When you do

ssh user@a.company.com -L 1234:localhost:5678

on host b.company.com, the following happens:

• On host B, ssh starts to listen on port 1234.
• On host A, a connection is made to localhost (that is, host A again) on port 5678.
• Traffic on those two endpoints is forwarded over the ssh connection between A and B.

So the end result is that you can access port 5678 on host A by using port 1234 on host B.

The reason you have to type localhost is because host A can also be a "jump server", i.e. an entrance point into some protected network. So if you can't access host C directly from host B, but you can access host A from host B, and host C from host A, you can do

ssh user@a.company.com -L 1234:c.company.com:5678

which will establish connections between host B and A, and between host A and C, and tunnel port 5678 on host C to port 1234 on host A.

This has two consequences:

• If you are already using port 1234 on your client (host B) for other services, you can't use it for tunneling. You need to use a different port (but there's plenty to choose from).

• In your browser, you'll always connect to the local endpoint of the tunnel, i.e. localhost. Assigning names to remote hosts won't change this.

So no, what you want doesn't work this way.

Edit

In case it wasn't clear enough: You can very easily use different port numbers to you are already running local services. So assume you have hosts A, B and C which you want to reach this way, they all have services on port 80, and you are running your own web server on port 80. Then you do

ssh user@hosta -L 5000:localhost:80
ssh user@hostb -L 5001:localhost:80
ssh user@hostc -L 5002:localhost:80

and you can access them now in your browser by typing http://localhost:5000, http://localhost:5001, and http:/localhost:5002. And http://localhost:80 will still access your own local server.

There's no real need for complicated constructions which involve assigning yourself lots of IP addresses, or remotealiases.