1

I often do port forwarding to access remote web servers with this command:

ssh user@remotehost -L 1234:localhost:1234

So now I can enter http://localhost:1234 in my browser to access the remote host's web server. What I want to do now is use a name other than localhost. For example, is it possible to invoke ssh with some argument such that I can enter http://remotealias:1234 in my browser to access the remote web server? This is particularly useful when I'm running other services in my local machine on port 1234 at the same time (and don't want to remember many port:host tunnel mappings).

If it's not possible with the ssh command alone, I'm also interested in solutions that require editing some local configuration in my machine to make it work as described.

  • Have you tried to use SOCKS5 on your browser? ssh -D 1234 user@remotehost then configure SOCKS in your browser. – Valentin Bajrami Dec 6 '18 at 16:06
0

Yes; You could make an IP per host on your local box

ip address add 122.0.0.2/32 dev eth0
ip address add 122.0.0.3/32 dev eth0

and edit your hosts file

echo "127.0.0.2 remotehost1.com" >> /etc/hosts
echo "127.0.0.3 remotehost2.com" >> /etc/hosts

then forward each IP to the hosts IP (direct access via domain would be broken by the hosts file change)

ssh user@$remotehost1_IP -L 127.0.0.2:80:localhost:1234
ssh user@$remotehost2_IP -L 127.0.0.3:80:localhost:1234

then use your web browser like normal

http://remotehost1.com
http://remotehost2.com

This will tunnel each remote fqdn through its own ssh tunnel, on it's own local ip.

  • I'm not sure I understand this answer. As far as I know, I can't specify ports in the hosts file. – Mei Zhang Dec 5 '18 at 5:49
  • I'm still confused about what this is actually doing. What is the first command doing? And, did you mean remotealias in the second command? echo "172.0.0.2 remotealias" >> /etc/hosts – Mei Zhang Dec 5 '18 at 7:07
  • I think your answer should work. I don't know much about networking, but what's the criterion to create the IP addresses in the first command ip address add ? My local address starts with 10. and uses a different subnet mask. Should I add a similar address with the same mask? – Mei Zhang Dec 8 '18 at 6:33
  • @MeiZhang: The first command didn't get edited, it should be ip addr add 127.0.0.2/32 dev lo etc. instead. You are creating additional loopback addresses, which are independent from your "local address". And your local address is on some subnet, so definitely don't use variations of that. Multiple IPv4 addresses on an interface can work, but there are situations where they can lead to trouble, because programs without binding could pick a random address out of all available ones, which is sometimes not what you want. Another option would be to add a dummy interface. – dirkt Dec 8 '18 at 8:21
  • I see, I know this solution is a bit hacky, but this is exactly what I was looking for. – Mei Zhang Dec 8 '18 at 20:52
-1

When you establish port forwarding by ssh - you setup a bridge between port on your_machine:port (perspective of your machine) to machine:port from perspective of the machine you've made a connection to.

In other words - if you invoke command

ssh user@remotehost -L 1234:localhost:4567

you make an ssh connection to remotehost plus if you connect to port 1234 on your machine (localhost address for you) remote part of your ssh connection will try to make connection to localhost (to itself - as localhost on remotehost will point to itself) on port 4567

Back to the meritum of question.

If you have other services on port 1234 on your machine, you can instead select another port that is free on your machine.

  • Start with "No" if that's what you are going to imply. Though technically "Yes" is correct for this question. – user1133275 Dec 6 '18 at 13:11
-1

When you do

ssh user@a.company.com -L 1234:localhost:5678

on host b.company.com, the following happens:

  • On host B, ssh starts to listen on port 1234.
  • On host A, a connection is made to localhost (that is, host A again) on port 5678.
  • Traffic on those two endpoints is forwarded over the ssh connection between A and B.

So the end result is that you can access port 5678 on host A by using port 1234 on host B.

The reason you have to type localhost is because host A can also be a "jump server", i.e. an entrance point into some protected network. So if you can't access host C directly from host B, but you can access host A from host B, and host C from host A, you can do

ssh user@a.company.com -L 1234:c.company.com:5678

which will establish connections between host B and A, and between host A and C, and tunnel port 5678 on host C to port 1234 on host A.

This has two consequences:

  • If you are already using port 1234 on your client (host B) for other services, you can't use it for tunneling. You need to use a different port (but there's plenty to choose from).

  • In your browser, you'll always connect to the local endpoint of the tunnel, i.e. localhost. Assigning names to remote hosts won't change this.

So no, what you want doesn't work this way.

Edit

In case it wasn't clear enough: You can very easily use different port numbers to you are already running local services. So assume you have hosts A, B and C which you want to reach this way, they all have services on port 80, and you are running your own web server on port 80. Then you do

ssh user@hosta -L 5000:localhost:80
ssh user@hostb -L 5001:localhost:80
ssh user@hostc -L 5002:localhost:80

and you can access them now in your browser by typing http://localhost:5000, http://localhost:5001, and http:/localhost:5002. And http://localhost:80 will still access your own local server.

There's no real need for complicated constructions which involve assigning yourself lots of IP addresses, or remotealiases.

  • Read my answer and realize what he wants is possible if one gets creative. – user1133275 Dec 6 '18 at 13:07
  • @user1133275: At least in the current edit, you probably don't want to add 122.0.0.2/32 etc. to eth0, since you are using 127.0.0.2 on lo anyway... And IMHO it's much easier to just use free port numbers (I have the feeling the OP maybe didn't realize he can use different numbers for his 1234 before and after localhost) instead of having to deal with multiple IP addresses on loopback, which can lead to all sort of funny effects. Just because you can do something and it might even work under limited circumstances, doesn't mean it's a good solution. YMMV. – dirkt Dec 6 '18 at 13:25
  • That take on the question turns it from a good question into a low quality question that should be deleted. So let's make stackexchange better by reducing the bloat and answer the questions that are not just a copy of the man pages. – user1133275 Dec 6 '18 at 15:58
  • I'm aware that I can use a different port before and after localhost. For reasons that are not important to discuss, I do want to use the same port number. – Mei Zhang Dec 8 '18 at 7:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.