Return to Revisions

This is explained in SSH manual, especially the differences between -L (local) and -R (remote).

-L

-L [bind_address:]port:host:hostport

Specifies that the given port on the local (client) host is to be forwarded to the given host and port on the remote side.

This works by allocating a socket to listen to port on the local side, optionally bound to the specified bind_address.

Whenever a connection is made to this port, the connection is forwarded over the secure channel, and a connection is made to host port hostport from the remote machine.

The following example tunnels an IRC session from client machine 127.0.0.1 (localhost) using port 1234 to remote server server.example.com:

$ ssh -f -L 1234:localhost:6667 server.example.com sleep 10

^{Note: The -f option backgrounds ssh and the remote command sleep 10 is specified to allow an amount of time to start the service which is to be tunnelled.}

Example:

ssh `-N` -L 22000:localhost:11000 remote.server.com

• -N After you connect just hang there (you won't get a shell prompt)

  Do not execute a remote command.

• -L 22000 The connection will originate on port 22000 of your personal, Local machine

• localhost:11000 - remote.server.com will make sure that the other end of the tunnel is localhost, port 11000

^{Source: An illustrated guide, tutorial, how-to, on ssh tunneling.}

-R

-R [bind_address:]port:host:hostport

Specifies that the given port on the remote (server) host is to be forwarded to the given host and port on the local side.

This works by allocating a socket to listen to port on the remote side, and whenever a connection is made to this port, the connection is forwarded over the secure channel, and a connection is made to host port hostport from the local machine.

Example:

ssh -N -R 22000:localhost:11000 remote.server.com

• -N After you connect just hang there (you won't get a shell prompt)

  Do not execute a remote command.

• -R 22000 The connection will originate on port 22000 of the Remote computer (in this case, remote.server.com)

• localhost:11000 your personal, local computer will make sure that the other end of the tunnel is localhost, port 11000

^{Source: An illustrated guide, tutorial, how-to, on ssh tunneling.}