1

Dynamic port forwarding using SSH knows where a request wants to go and sends it there, which is said to be due to using the SOCKS protocol.

Local and remote port forwarding using SSH forward a request to a fixed destination, instead of where the request indicates itself to go.

Is the above difference between dynamic and local/remote port forwarding because local and remote port forwarding work at a lower level protocol and doesn't have the ability to understand where a request wants to go, or because local and remote port forwarding work has the ability to know where a request wants to go but just doesn't do it?

For example, we can discuss in the following case: a HTTP client sends a HTTP request to SSH which is for either dynamic or local/remote port forwarding.

Thanks.

  • With dynamic forwarding, ALL traffic directed at the SOCKS proxy is passed through the tunnel. Part of the SOCKS protocol is to manage the destination and port. Local and remote tunnels are explicit destinations, so any traffic through those forwarded connections are already defined before the traffic is sent. – jsbillings Feb 6 at 13:58
1

The difference is in what the client thinks it is talking to. Taking HTTP as an example:

SSH static (local and remote) port forwards are transparent to the application using them. With HTTP the application (the browser) doesn't know it's talking to a port forward at all. For a local forward, it thinks it's talking directly to a web server running on the client ("localhost"). SSH fakes the webserver, by passing all traffic to a real webserver.

SSH dynamic port forwards are not transparent. The application (the browser) thinks it is talking to a "SOCKS proxy server", not a webserver. The application uses the SOCKS proxy server to request a connection to a webserver. It then thinks it is talking to a webserver (NOT on the SSH server or client) via the socks proxy.

As a side point, it;s possible to download and install a SOCKS proxy on a server, create a local port forward to it, and the result will be the same as a dynamic forward.

  • Thanks. Is SSH which performs local or remote port forwarding considered as a proxy?See unix.stackexchange.com/questions/498849/… – Tim Feb 6 at 15:29
  • Is a HTTP proxy server not transparent to a HTTP client, just a SSH dynamic port forwarding proxy server is not? – Tim Feb 6 at 15:38
  • A HTTP proxy server is different again. And no. The browser needs to know it's talking to a HTTP proxy. The protocol for talking to a HTTP proxy is different to that for a web-server. From memory, the domain is split into a separate header for a regular web-server, for a proxy it's in the url. A reverse HTTP proxy is transparent. – Philip Couling Feb 6 at 15:43
  • Thanks. How about my first comment? – Tim Feb 6 at 16:48
  • I think, technically, yes they are. But but I would usually just call them a "port forward" to be clear because there are so many different types of proxy. – Philip Couling Feb 6 at 18:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.