Hello, and welcome to today's video presentation on using SSH tunnels.
SSH tunneling or SSH port forwarding provides a way to encapsulate TCP traffic for any port
and forward it through an SSH connection.
When defining your tunnel, SSH has three types :
Local Port Forwarding is used to forward a port from the client to the server.
Remote Port Forwarding is used to forward a port from the server to the client.
and
Dynamic Port Forwarding is used to creates a SOCKS proxy with access to a range of ports.
So let us get started.
Local port forwarding is useful when securely connecting to remote services, such as databases,
VNC servers, and FTP Servers, behind a secure network.
When using local port forwarding, the SSH client listens on a local port and then tunnels
any traffic to the remote host and port.
The remote host and port can be the same as the SSH server (localhost) or another server
on the secure internal network.
In our example, we create an auto-closing local port forward for VNC.
In a terminal, type:
ssh -L 5910:localhost:5901 -f ol8-ssh sleep 30
-L establishes a local port forwarding tunnel to the remote server.
5910 opens the local port, where we listen for incoming traffic for the tunnelled application.
localhost:5901 attaches the tunnel to the remote application's host and port.
Using localhost for the remote application host indicates that the VNC server is running
on the same host as the SSH remote server.
-f forks the ssh process and runs the tunnel in the background.
ol8-ssh defines the remote SSH server host.
For these exercises, I am using ssh key-based authentication and have the username, and
public key defined as a Host in my client-side ssh config file.
The sleep 30 command executes a wait for 30 seconds on the remote server.
The sleep command is the primary job of this ssh session, while the tunnel is secondary.
The sleep command works as a timer for how long the tunnel will wait for a connection
before the ssh session closes.
If a vncviewer application connects to the local port forward within the 30 seconds,
the tunnel remains open.
To test this example, hit enter after the command typed.
The terminal will return to the prompt as if nothing happened and start the tunnel.
To show the created tunnel process running in the background, type:
pgrep -a ssh
Next, Open the Vinagre application and connect to the remote VNC server using the tunnel.
Type:
vinagre localhost:5910
With the vncviewer connected, we have verified the tunnel works.
Close the Vinagre application by clicking the x in the upper right corner of the app
window.
The tunnel will auto-close when Vinagre closes as the primary job of executing the sleep
30 already completed.
Verify the tunnel closed by typing:
pgrep -a ssh
The tunnel process shown before, as expected, is gone.
Administrators use the next port forwarding type less often compared to Local port forwarding.
Remote port forwarding is useful to open a port on the remote server that listens for
a connection.
That connection returns traffic to a local service running on the client-side.
The example we will cover shares a webserver running on your local computer with a remote
user.
Since the local computer does not have a public-facing IP address, this tunnel will allow access
to the webserver using the remote ssh server host.
Using Python 2.7, you can start a simple web server using the command:
python -m SimpleHTTPServer 8888
This command will start a webserver listening on port 8888.
In the directory where we started this process, I have a HelloWorld index.html page.
In another terminal window or tab, start the remote tunnel using the command:
ssh -R 1234:localhost:8888 ol8-ssh
-R establishes a remote port forwarding tunnel.
1234 sets the port on the remote ssh server listening for connections.
localhost:8888 is the host and port of the webserver on the client-side.
ol8-ssh, again, defines the remote SSH server host.
I did not send the tunnel process to the background using the -f option as I plan to use the interactive
ssh session to run our test.
Hit Enter to execute the command and start the tunnel.
In the terminal, use curl and connect to the webserver using http://localhost:1234.
The traffic will be sent securely back to the client-side computer and display a HelloWorld
message from the webserver.
Now that we have verified the tunnel works type exit to close the tunnel.
Switch to the other terminal window or tab, and use ctrl-c to terminate the Python webserver.
Last is the dynamic port forwarding, which creates a socks proxy by opening a port on
the local computer.
Using this proxy, we will route all browser traffic through the ssh tunnel.
For this example, we use the ol8-ssh box as our client-side and run the browser there.
The ol8-ssh (guest) system is running in VirtualBox configured with a NAT-based network.
Since we plan to use the VirtualBox host for the SSH server, we will create a reverse tunnel
from the host to the guest so the guest can easily ssh to the host.
In the host terminal, type:
ssh -R 43022:localhost:22 ol8-ssh -f -N
43022 opens a port that will be used by the dynamic port forward connection on the guest
and connect using localhost.
localhost:22 defines the host's ssh server.
The previous examples demonstrated in this video explain the other options in the command.
Hit enter and establish the reverse tunnel.
Open a terminal on the ol8-ssh guest box.
Type:
ssh -D 8080 -p 43022 opc@localhost -f -N
8080 opens the SOCKS proxy port we put in the browser preferences.
43022 connects to the guest ssh session to create the proxy through the established reverse
tunnel.
opc@localhost defines the host's SSH server username and host.
-f -N forks the process, runs it in the background, and does not run a remote command.
Hit enter, and the SOCKS proxy starts in the background.
Next, update your browser settings.
Open your browser.
We will use Firefox in this case as it gets installed as part of the Gnome Desktop.
Click the hamburger menu in the upper right corner of Firefox and select Preferences.
Scroll down to Network Settings and click the Settings button.
Click the Manual proxy configuration radio button.
Enter localhost for the SOCKS Host and 8080 for the port.
Click the OK button.
The port used when creating the dynamic tunnel can be any port not currently in use on your
client.
Test that the tunnel works by accessing the URL http://www.oracle.com.
The browser will display the website.
We can verify the SOCKS proxy was used by stopping the proxy and try re-accessing the
URL.
To terminate the SOCKS proxy from the terminal, type:
pgrep -a ssh
Locate the PID of the proxy process and then type:
kill -9 and the PID of the process
Refresh the browser window.
Since the proxy is not running, the browser will display a refusing connections message.
If the browser did display the URL, then you might need to clear your browser cache or
wait a bit before testing again.
The dynamic port forwarding feature of ssh works as an excellent option when you are
using public WiFi and wanting to avoid others nearby sniffing your packets.
Hopefully, these examples were useful as they show just some of the ways to utilize ssh.
Additional information on using SSH with Oracle Linux and Oracle Cloud is available in the
Oracle documentation.