SSH tunneling

Sometimes you might be elsewhere, but need to log in to a system on your network via e.g. VNC or RDP. You don't have a VPN at hand, the firewall of course doesn't allow VNC or RDP and you are in desperate need of that connection.

Well, if there's an SSH server running on the remote network that is reachable from the internet, you can easily tunnel the connection through SSH.

Just run one simple command on your local machine:

ssh -C -N -L <local port>:<remote machine to connect to>:<remote port> <ssh-server>

Afterwards, connect to localhost:<local port> and you are done!

Note that it will seem as if your SSH connection hangs because no login will happen. That is normal, as soon as you <Control> + <c> the SSH it will also kill the tunnel.

Assumptions:

• Locally port 5900 is already in use, so you use port 5901.
• The machine you need to control but is not reachable on the internet has IP-address 192.168.17.123 and it waits for VNC connections on port 5900.
• The ssh-server is available on IP-adress 1.2.3.4 and you need to use the username “user” to log in to that machine.

In that case the ssh-command would look like this:

ssh -C -N -L 5901:192.168.17.123:5900 user@1.2.3.4

Then, connect your vncviewer to localhost and you “get the picture”:

 vncviewer localhost:5901

Assumptions:

• Locally port 3389 is free.
• The machine you need to control but is not reachable on the internet has IP-address 192.168.17.123 and it waits for RDP connections on port 3389.
• The ssh-server is available on IP-adress 1.2.3.4 and you need to use the username “user” to log in to that machine.

In that case the ssh-command would look like this:

ssh -C -N -L 3389:192.168.17.123:3389 user@1.2.3.4

Then, connect your RDP viewer to localhost and you “get the picture”:

rdesktop localhost

There might be a situation when you want to tunnel a whole website through an SSH connection running to another host. For example, if you do not trust VPN providers (which you maybe shouldn't) but still want to circumvent certain geolocation issues.

Websites can be tricky though because of heavy third-party integrations nowadays, so the easiest way to do that is to create a SOCKSv5 proxy and use that in your browser.

To start the proxy, run this SSH command:

ssh -C -N -D 8080 <remote machine to connect to>

Afterwards, use localhost and port 8080 as the SOCKSv5 proxy in your browser. Please refer to your browsers manual where and how to set a Proxy, I find it easiest in Firefox:

Menu → Settings → General → Network Settings → Settings → Manual Proxy Configuration

These SSH options are used:

For more information please see man ssh.