Jump to content

SSH Port Forwarding: Difference between revisions

SSH Port Forwarding (view source)

Revision as of 23:59, 20 April 2026

1,440 bytes removed ,  20 April
no edit summary
(update images to align and be less crappy looking)
No edit summary
 
(4 intermediate revisions by 2 users not shown)
Line 1: Line 1:
{{Outdated}}
==Why?==
==Why?==
One example of why port forwarding is great is security. Downloading email and browsing the Internet in such a way that the immediate (local) network does not know what you are doing. All it sees is encrypted SSH traffic, like that used when you type on RedBrick normally.
One example of why port forwarding is great is security. Downloading email and browsing the Internet in such a way that the immediate (local) network does not know what you are doing. All it sees is encrypted SSH traffic, like that used when you type on RedBrick normally.
Line 38: Line 41:


Where :
Where :
* -L specifies you want to link a local port
* -D specifies you want to link a dynamic port
* 1337 is the local port (on your machine) you want to communicate on.
* 1337 is the local port (on your machine) you want to communicate on.
* proxy.dcu.ie is the server you want to send your tunnelled traffic to.
* 3128 is the port on that server you want to send your tunnelled traffic to.
* login.redbrick.dcu.ie is the server you want to open the SSH connection to
* login.redbrick.dcu.ie is the server you want to open the SSH connection to
[[Image:Tunnelling-network-diagram.png]]
For example, to tunnel local port 1337 to the SOCKS proxy on proxy3.dcu.ie through deathray:
ssh -L 1337:proxy3.dcu.ie:1080 login.redbrick.dcu.ie
Here we see that we specify the proxy definitively, and use the port that we
would eventually negotiate (for those of you is res try running Wireshark, you will
see what I mean). We also use a specific Redbrick server, Login (minerva) for our port
forwarding (there are restrictions on tunnelling through our other machines). You can also add the ''-v'' option to specify 'verbose' mode and see the port being opened and closed for your tunnelled traffic.
Try running netstat locally and and you should see 1337 sitting there happily.
So now you have it all set up, congratulations! Now, how do you use it? Easy!
Open up your browser and change the proxy settings to localhost:1337, you
will then be using the local port to forward traffic to the DCU proxy, the same
applies to your mail program.
Note this only encrypts your traffic to and from Redbrick, so anyone listening
on the wifi hotspot you are using will just see garbage going to DCU (figures),
anyone listening to DCU traffic from the proxy can still see you stuff, the moral
being ”don't go downloading donkey porn” DCU will still be out to get you, etc.
So, thats it, enjoy you new found 1337ness.
niT.


==Port forwarding for IRC==
==Port forwarding for IRC==


Since ircproxy is offline, and will probably remain so (it was fairly shite anyway), if you want to connect to RedBrick IRC with your own client you will need to use port forwarding to do this.
If you want to connect to RedBrick IRC with your own client you will need to use port forwarding to do this.


The process is the same as the above, just using different addresses and port configurations.
The process is the same as the above, just using different addresses and port configurations.
Line 79: Line 55:
  remote port: 6667
  remote port: 6667


So, you're basically substituting 1337 and 3128 for 6667, and proxy3.dcu.ie for irc.redbrick.dcu.ie.
So for this it is instead using a local forward. So unlike the dynamic forward, instead set the option to be local, and add the destination as being irc.redbrick.dcu.ie:6667
 
On CLI this is:
 
ssh -L 6667:irc.redbrick.dcu.ie:6667 username@login.redbrick.dcu.ie


Now, just tell your irc client that your irc server is localhost :)
Now, just tell your IRC client that your IRC server is localhost :)


[[Category:HowTo]]
[[Category:HowTo]]
Retrieved from "https://wiki.redbrick.dcu.ie/Special:MobileDiff/10818...11370"