SSH tunneling through a busybox router

I have drawn some sketches

The machine, where the ssh tunnel command is typed is called »your host«.

Introduction

1. local: -L Specifies that the given port on the local (client) host is to be forwarded to the given host and port on the remote side.

   ssh -L sourcePort:forwardToHost:onPort connectToHost means: connect with ssh to connectToHost, and forward all connection attempts to the local sourcePort to port onPort on the machine called forwardToHost, which can be reached from the connectToHost machine.

2. remote: -R Specifies that the given port on the remote (server) host is to be forwarded to the given host and port on the local side.

   ssh -R sourcePort:forwardToHost:onPort connectToHost means: connect with ssh to connectToHost, and forward all connection attempts to the remote sourcePort to port onPort on the machine called forwardToHost, which can be reached from your local machine.

Your example

Home computer runs linux

This is image number three of my sketches. Is your home computer running linux? And you have a remotehost somewhere in the internet which has ssh on it and you can simply access it from your home computer using

ssh remotehost

Then you surely have ssh installed and you don’t even need the router to create your tunnel. Use the following command on your computer (the blue box called yourhost represents your home computer):

ssh -R 11111:localhost:22 remotehost

Now if you are sitting at the remotehost and want to connect to your home computer via ssh, use this command

ssh -p 11111 homeuser@localhost

which will start a ssh connection to the green port 11111 on your remotehost, which is forwarded through the ssh tunnel (which even passes your busybox router) and connect to the pink port 22 of your home computer’s localhost (which is your home computer itself).

Of course busybox can also establish the tunnel

This is image number 4 of my sketches. You are now sitting at (or logged into) the busybox. So yourhost is the busybox router.

ssh -R 11111:nearhost:22 remotehost

Now when you are at the remotehost, you type again

ssh -p 11111 busyboxuser@localhost

to connect to the green port 11111 which is then forwarded through the tunnel to the busybox, and from there it is connected to the pink port 22 of the nearhost (representing your home computer).

ssh -L is what you're looking for.

Lets draw a picture that has 4 total hosts, A, B, X, Y.

• A is the machine that has your regular client, lets say, web browswer
• B is your nearest local SSH capable machine, which might be the same as A.
• X is your remote SSH capable machine
• Y is the machine hosting the service (lets say, web server) you wish to access from A. Y can be the same host as X.

On B:

ssh -Nn -L 8080:Y:80 username@X

This establishes a tunnel:

B:8080 <--- encrypted over ssh ---> X < ---- unencrypted ----> Y:80

Then A can connect to B:8080 and see Y:80:

A <--- unencrypted ---> B:8080 <--- encrypted over ssh ---> X < ---- unencrypted ----> Y:80

If A is the same machine as X, and B is the same machine as Y, then the unencrypted legs never actually go over a real network; your web browser connects to localhost:8080 (tunnel start); the ssh server on X connects to localhost:80.