445

I love explaining this kind of thing through visualization. :-) Think of your SSH connections as tubes. Big tubes. Normally, you'll reach through these tubes to run a shell on a remote computer. The shell runs in a virtual terminal (tty). But you know this part already. Think of your tunnel as a tube within a tube. You still have the big SSH ...


403

I have drawn some sketches The machine, where the ssh tunnel command is typed is called »your host«. Introduction local: -L Specifies that the given port on the local (client) host is to be forwarded to the given host and port on the remote side. ssh -L sourcePort:forwardToHost:onPort connectToHost means: connect with ssh to connectToHost, and forward all ...


147

channel 1: open failed: administratively prohibited: open failed The above message refers to your SSH server rejecting your SSH client's request to open a side channel. This typically comes from -D, -L or -w, as separate channels in the SSH stream are required to ferry the forwarded data across. Since you are using -L (also applicable to -D), there are two ...


86

As said in other posts, if you don't want a prompt on the remote host, you must use the -N option of SSH. But this just keeps SSH running without having a prompt, and the shell busy. You just need to put the SSH'ing as a background task with the & sign : ssh -N -L 8080:ww.xx.yy.zz:80 user@server & This will launch the ssh tunnelling in the ...


85

An especially good solution for scripting is to use master mode, with a socket for control commands: ssh -f -N -M -S <path-to-socket> -L <port>:<host>:<port> <server> To close it again: ssh -S <path-to-socket> -O exit <server> This avoids both grepping for process ids and any timing issues that might be ...


64

-f -N is what you are looking for: ssh -f -N -L MY_LOCAL_PORT:FOREIGN_ADDRESS:FOREIGN_PORT MYUSER@SSH_SERVER From the ssh man page: -f Requests ssh to go to background just before command execution. This is useful if ssh is going to ask for passwords or passphrases, but the user wants it in the background. This implies -n. -N Do not execute a ...


61

In a very weird case, I also experienced this error while trying to create a local tunnel. My command was something like this: ssh -L 1234:localhost:1234 user@remote The problem was, on the remote host, /etc/hosts had no entry for "localhost" so the ssh server didn't know how to setup the tunnel. A very unfriendly error message for this case; glad I ...


52

I found the solution here: http://www.g-loaded.eu/2006/11/24/auto-closing-ssh-tunnels/ The best way – Tunnels that auto-close As it has been mentioned previously, instead of using the -f -N switch combination, we can just use -f alone, but also execute a command on the remote machine. But, which command should be executed, since we only need to initialize ...


35

BindAddress is not the option you're after. From man ssh_config: BindAddress Use the specified address on the local machine as the source address of the connection. Only useful on systems with more than one address. The configuration file equivalent of -R is RemoteForward: RemoteForward Specifies that a TCP port on the ...


31

Jakuje's answer is right, but since OpenSSH 7.3, you can now use -J ProxyJump which is easier. See my notes: OpenSSH 7.3 or above Use ProxyJump. As explained in the manual: -J [user@]host[:port] Connect to the target host by first making an ssh connection to the jump host and then establishing a TCP forwarding to the ultimate destination from there. ...


29

It is possible to add multiple lines of LocalForward: Host myhost Hostname 123.123.123.123 IdentityFile ~/.ssh/id_myhost LocalForward 8811 localhost:8811 LocalForward 6006 localhost:6006 IdentitiesOnly yes Is this what you want?


25

ssh tunneling works by using the already established ssh connection for sending additional traffic. When you connect to a remote server, you usually just have 1 channel for the normal user interaction (or 3 channels if you consider STDIN/STDOUT/STDERR separate). At any time, the local or remote ssh process can open additional channels on the existing ...


25

Yes, there is. ssh & runs ssh in the background from the very beginning. ssh -f starts ssh in the foreground, allowing it to prompt for passwords etc., and only afterwards ssh puts itself in the background just before executing the requested command.


22

From the SSH Protocol documentation, regarding channels: All terminal sessions, forwarded connections, etc., are channels. Either side may open a channel. Multiple channels are multiplexed into a single connection. Channels are identified by numbers at each end. The number referring to a channel may be different on each side. Requests to ...


21

I have drawn some sketches The machine, where the ssh tunnel command is typed (or in your case: Putty with tunneling is started) is called »your host«. Introduction local: -L Specifies that the given port on the local (client) host is to be forwarded to the given host and port on the remote side. ssh -L sourcePort:forwardToHost:onPort connectToHost means:...


21

My solution was similar to @slm's but I used SOCKS instead because it is simpler and required no proxy installation on the server or client. Run all commands on the computer with restricted acccess. in yum.conf set the proxy as follows proxy=socks5h://localhost:1080 from a terminal type ssh -D 1080 YOUR_USER@YOUR_SERVER_WITH_FULL_WEB_ACCESS press enter ...


20

If the 'remote' cannot be resolved on the server you will get that error. Replace with an IP address and see if that resolves your issue... (Basically same answer as that of Neil - but I certainly found that to be the issue on my side) [I had an alias for the machine name in my ~/.ssh/config file - and the remote machine knew nothing of that alias...


19

This is explained in SSH manual, especially the differences between -L (local) and -R (remote). -L -L [bind_address:]port:host:hostport Specifies that the given port on the local (client) host is to be forwarded to the given host and port on the remote side. This works by allocating a socket to listen to port on the local side, optionally bound to the ...


18

If you have a low bandwidth I recommend compression of the video stream (still works in 2020). with ffmpeg and mplayer ssh USERNAME@REMOTEHOST ffmpeg -an -f video4linux2 -s 640x480 -i /dev/video0 -r 10 -b:v 500k -f matroska - | mplayer - -idle -demuxer matroska where -an turns off audio encoding. If you want audio, replace -an with -f alsa -ac 1 -i hw:3 (...


18

After discussing this in a chat and debugged the issue, it turned out that the required directive PermitTunnel yes was not in place and active. After adding the directive to /etc/ssh/sshd_config and reloading sshd by service sshd reload this was resolved. We added -v to the ssh command to get some debugging information and from that we found: debug1: ...


16

The simple answer is yes, but please note that the tunnel is actually started on your computer. The way it works is that you create an SSH connection to the server (which is secure) and then instruct the SSH to listen to a port on your side and forward whatever connections come in - to a specific port on a specific host address on the server side. The target ...


15

OpenSSH will flat-out refuse to bind to privileged ports unless the user id of the logged in user is 0 (root). The relevant lines of code are: if (!options.allow_tcp_forwarding || no_port_forwarding_flag || (!want_reply && listen_port == 0) || (listen_port != 0 && listen_port < IPPORT_RESERVED && pw->pw_uid != 0)...


15

No, ssh doesn't support regular expression in ssh_config (1) and the example you gave aren't regular expressions. ssh_config (1) supports PATTERNS, i.e. you can define a pattern for your IPs, i.e: Host 192.168.1.* ProxyCommand ssh production-server nc %h %p and you should be able to have forwarding for all your internal IPs. Another solution would be to ...


15

To kill the tunnel, use ps -C ssh or ps | grep ssh or any other variant to determine which ssh process is running your tunnel. Then kill it. Alternatively, you can look for the process by determining which one has this port open: netstat -lnpt | awk '$4 ~ /:1234$/ {sub(/\/.*/, "", $7); print $7}' If you want to kill all ssh clients running on your machine ...


15

Just adding some more and clear steps to @Lawrence and @SpiRail's answers. Do the setup as follows: Setup on Host A: Install proxy server Squid on Host A . By default Squid listens on port 3128. yum install squid Comment the http_access deny all then add http_access allow all in /etc/squid/squid.conf If Host A itself uses some proxy say 10.140.78.130:8080 ...


15

You get locked out of your VPS because once the VPN service is up, your ssh packets get routed via the VPN not your VPS's public IP 50.2.1.3. Lets assume your server's: Public IP is 50.1.2.3 (as per your example setup) Public IP Subnet is 50.1.2.0/24 Default Gateway is x.x.x.1 eth0 is device to gateway Do the following using iproute2: ip rule add table ...


15

The option you are looking for is not AllowTunnel (it is for VPN and level 3 forwarding using tun devices). You are looking for AllowTcpForwarding, which handles local and remote port forwarding of TCP traffic in ssh. Have a look what values is in your server and change it to yes: AllowTcpForwarding yes


14

What you're looking for is called a reverse tunnel. ssh provides it through the -R switch: -R [bind_address:]port:host:hostport Specifies that the given port on the remote (server) host is to be forwarded to the given host and port on the local side. This works by allocating a socket to listen to port on the remote side, and ...


14

OpenSSH 7.6 introduced reverse dynamic proxy as a native option. It is implemented entirely in the client, so the server does not need to be updated. ssh -R 1080 server


14

Use the -N option -N Do not execute a remote command. This is useful for just for- warding ports (protocol version 2 only). Example ssh -fN -L 8999:localhost:6006 host


Only top voted, non community-wiki answers of a minimum length are eligible