The Complete Guide to Setting Up SSH Tunneling on Linux

SSH tunneling leverages encrypted SSH connections to securely route traffic, bypass restrictive networks, and access private local services remotely. This comprehensive 3000+ word guide will take you from basic port forwarding concepts to advanced SSH tunneling features.

We will compare SSH to other VPNs, analyze the protocol under the hood, discuss security vulnerabilities, and demonstrate practical examples. By the end, you’ll have expert-level understanding of leveraging OpenSSH for tunneling.

An In-Depth Introduction to SSH Tunneling

What is SSH Tunneling?

SSH tunneling, also called SSH port forwarding, provides a secured private tunnel routed through an encrypted SSH connection from your local computer to a remote network. Traffic forwarded through this tunnel emerges from the SSH server – obscuring the true originating source.

Why Use SSH Tunneling?

There are two major reasons system administrators, developers, and IT professionals utilize SSH tunneling:

1. Accessing Remote Local Services – Forward traffic to ports on the remote SSH server network that wouldn‘t be directly reachable otherwise. This allows you to securely access databases, web apps, file shares, and other on-premise resources.

2. Bypassing Network Restrictions – Many networks block non-web protocols and ports for security purposes. Piping traffic through SSH tunnels lets you bypass these restrictions by piggybacking blocked protocols within the secured SSH stream.

For example, your corporate firewall may block SMTP email connections. Set up an SSH tunnel through a gateway server, and route SMTP through that – enabling usage despite restrictions.

SSH Tunneling Capabilities

The SSH protocol supports three main types of port forwarding:

Forwarding Method	Description	Use Cases
Local Port Forwarding	Forwards a local port to a remote destination	Access remote services like databases privately
Remote Port Forwarding	Forwards a remote port to a local destination	Expose services securely to authorized external users
Dynamic Port Forwarding	Acts as a SOCKS proxy server	Route web traffic through remote SSH server

We will cover local and remote port forwarding first as those are the basics. Dynamic forwarding requires more complex setup.

How Does SSH Tunneling Work?

SSH tunnels leverage the existing encryption and security of the SSH protocol to provide safe "tunnels" for other traffic to route through.

When you set up port forwarding over SSH, this is what happens under the hood:

1. Initial Key Exchange – An SSH session starts with authentication and encryption key exchanges to establish a secured, encrypted link.

2. TCP/IP Socket Reservation – Ports are reserved with TCP/IP socket rules on both the local and remote ends when you define SSH port forwarding.

3. Traffic Redirection – Any traffic to the reserved ports gets encrypted and sent through the SSH tunnel automatically, emerging from the other side.

4. Listening Server Forwards Packets – The listening server (remote SSH) receives the forwarded traffic and redirects it to the defined destination server and port.

So in essence, you have a secured tunnel between two endpoints with "gateways" that redirect traffic down the tunnel and out the other side. This is why SSH tunnels are useful for bypassing filters – the protocols get wrapped in encryption.

Comparing SSH to OpenVPN

SSH port forwarding tunnels only route TCP or UDP traffic, whereas VPN protocols like OpenVPN work for any IP traffic by simply encoding everything into the VPN tunnel link.

However, the huge advantage of SSH tunnels is that you likely already have access to secured SSH servers within private networks. So tunneling builds right on top of existing infrastructure, without needing dedicated VPN gateways.

Criteria	SSH Tunnels	OpenVPN
Encryption	Leverages existing SSH encryption	Potentially stronger encryption
Convenience	Based on ubiquitous SSH access	Requires dedicated VPN servers
Flexibility	Forwards only TCP/UDP ports	Encrypts any IP traffic
Speed	Wraps protocols in 2 layers, slower	Direct 1 layer encryption, faster

Now that you understand the basics of SSH tunneling and how it compares to other VPN solutions, let‘s dive into practical examples and usage…

Step 1 – Establish the Secure SSH Link

The starting point for any SSH tunnel is an authenticated SSH connection between the tunnel endpoints:

For maximum security on an active tunnel, you should configure SSH key authentication instead of using password logins which are vulnerable to brute force attacks.

Here is an overview of setting up key-based auth for SSH tunneling:

1. Key Generation – Create RSA keypair on local computer with ssh-keygen (no passphrase needed for scripts)
2. Copy Public Key – Transfer public key to .ssh/authorized_keys on remote server
3. Key File Permissions – Set proper ownership and file permissions for the authorized_keys and .ssh directories
4. SSH Server Config – Enable key auth as primary and disable password login and root access in sshd_config
5. Firewall Rules – Restrict source IP ranges allowed to connect on port 22/SSH

With key-based SSH authentication configured, you can now establish connections from your local machine without needing passwords or OTP tokens. This allows for automated tunnel sessions.

Now let‘s explore examples of local port forwarding and remote port forwarding…

Local Port Forwarding Tutorials

Local port forwarding listens on a port on your local machine, encrypts traffic, and sends it to the SSH server for redirection.

Common use cases include:

• Securely accessing application backends like databases or API services within private networks.
• Interacting with any TCP/IP service on a remote Linux server.
• Running remote services through a corporate proxy or firewall that blocks direct access.

Let‘s walk through some common examples of local SSH port forwards…

Forward Mail Server Access through Corporate Firewall

Say your company firewall blocks external SMTP connections, but you need to access the corporate mail server from home at IP 192.168.55.102 listening on port 25.

Here is how to tunnel SMTP traffic to it:

# On Local Machine
$ ssh -L 13330:192.168.55.102:25 gw.company.com 

# SMTP traffic sent to localhost:13330 gets 
# forwarded by the SSH server to the internal 
# mail server at 192.168.55.102:25

This allows you to point your email client at 127.0.0.1:13330 for the connection. Then route commands through the SSH tunnel to evade firewall filters.

Interact with Remote Database Server

Many applications utilize databases for storage and data lookup. Here is how you can access one privately over SSH:

# DB server runs internally at 192.168.20.53:8080
$ ssh -L 8853:192.168.20.53:8080 ssh.domain.com

# Forward connects to DB at 192.168.20.53:8080
# Local apps can now interact with 127.0.0.1:8853

Developers and support engineers often SSH tunnel to safely access non-public databases for troubleshooting or maintenance.

Summary of Local Port Forwarding Steps

1. Identify service port and IP on remote private network to access
2. Choose an available high-numbered local port for forwarding
3. Set up SSH tunnel specifying:
   • -L for local forwarding
   • local_port:remote_host:remote_port
4. Connect locally to 127.0.0.1:local_port to access the remote service privately

Next let‘s explore remote SSH port forwarding…

Remote Port Forwarding Guide

Remote port forwarding (reverse tunneling) is the opposite of local forwarding. Your SSH server listens on a port, encrypts data, and forwards that to your local machine.

Some common use cases include:

• Temporarily exposing internal web servers securely to outside public internet traffic
• Allowing external monitoring systems to check services running in private networks
• Enabling remote access to databases behind strict firewall policies

Expose Web Server to Authorized External Users

Say you have an internal web server running at 192.168.123.11:80, and want to grant temporary external access to QA testers and clients.

Using SSH remote port forwarding:

# On Remote Server 
$ ssh -R 443:192.168.123.11:80 external.myserver.com

# External users can now browse to https://external.myserver.com 
# Which forwards traffic to local web server at 192.168.123.11:80

This approach avoids needing a dedicated VPN or firewall rule changes. You can revoke access instantly by terminating the SSH process forwarding port 443.

Let Monitoring Service Access Devices Internally

Perhaps you want an external automated service to pull system telemetry from devices on internal networks:

# Sensor system runs internally at 192.168.5.72:9100
$ ssh -R 19000:192.168.5.72:9100 my.server.com 

# External monitoring can now securely access
# port 9100 traffic via tunneled port 19000  

Closing the SSH session stops the forwarding and returns the network to its closed default state.

Key Steps to Configure SSH Remote Port Forwarding

1. Choose an available port on the remote SSH server to forward from
2. Find the destination IP and port on the internal private network
3. Tunnel with -R specifying remote_bind_port:destination_host:port
4. External resource connects to remote SSH server port for private secured access

Now that you have a solid foundation, let‘s explore some pro tips for production SSH tunnels…

Advanced SSH Tunnel Tips

There are many powerful features and capabilities available for controlling SSH connections beyond basic port forwarding:

1. Configure SSH Config File

Defining tunnels in SSH config instead of the CLI streamlines usage. Just reference tunnels by name.

2. Set Up SSH Bastion Hosts

Bastion hosts limit attack surfaces by proxying SSH internally through a dedicated gateway.

3. Utilize mosh Instead of SSH

Mosh brings mobility and robustness by handling network transitions without interrupting sessions.

4. Leverage sshuttle for Simple VPN

sshuttle transparently encapuslates all IP traffic into an SSH tunnel for VPN simplicity.

5. Tunnel GUI X11 Traffic

Forward remote GUI application displays for local interaction.

We don‘t have space to cover all those in-depth here. But I have full detailed guides for each linked below!

Now that you are a port forwarding expert, let‘s shift gears and explore SSH security…

Security Vulnerabilities and Best Practices

While SSH tunnels provide immense utility, the encryption tunnel is only as secure as the underlying SSH connection itself.

Attackers actively target both SSH server daemons and client configurations seeking vulnerabilities. Even encrypted SSH traffic exposes some metadata like packet size and timing that could betray sensitive details in the right context.

It‘s important to be aware of SSH security issues and misconfigurations that lead to compromised credentials and shells.

Common SSH Vulnerabilities

Here are some notable ways that SSH deployments often fall victim:

• Brute Force Attacks – Attackers hammer accounts with password guessing attacks. Using keys rather than passwords thwarts this.
• Misconfigurations – Poor SSH server and client configs open unnecessary risks like root login.
• Protocol Downgrade Attacks – Trick server into allowing weaker encryption protocols.
• Client-Side Attacks – Malware on a client collects account details and private keys. Integrity checks like ssh -v can identify this.
• Unsanitized Input Attacks – Sending malformed input can trigger crashes opening potential execution opportunities.
• Side-Channel Timing Attacks – Monitoring tunnel traffic timing reveals usage patterns. Adding randomness helps obfuscate.

Hardening SSH Tunnel Security

Here are some best practices for securing SSH tunnels:

• Utilize SSH Keys – Use key-based SSH authentication instead of password logins which are extremely vulnerable to credential stuffing.
• Leverage SSH Certificates – Centrally issue and revoke certificate credentials instead of static keys.
• Enable Multi-Factor Authentication – Add an extra verification step like Duo/OTP to the authentication flow.
• Run Separate SSH Service – Have a dedicated SSH server like sshd2 separate from sshd to compartmentalize blast radius.
• Restrict Users and Source IPs – Limit accounts allowed SSH access and firewall rules to reduce attack surface.
• Monitor Attempts and Alert – Log unauthorized connection tries and trigger alerts to identify brute force attacks.
• Stay Updated – Patch frequently and upgrade to new SSH releases to avoid publicly known vulnerabilities.

Properly hardened SSH servers with key authentication and least privilege concepts applied greatly reduce risks. But be vigilant scrutinizing access attempts in logs for signs of brute force or other suspicious activity.

Malicious actors are constantly exploring protocol weaknesses and implementation defects seeking undisclosed paths to exploit. Keep SSH security and best practices top of mind when managing forwarding tunnels long term.

Wrapping Up the Complete SSH Tunneling Guide

We‘ve covered a ton of ground here today. You now have extensive knowledge and examples for securely leveraging SSH tunnels:

• Set up local port forwarding to privately access TCP/IP services running remotely despite intervening restrictions.
• Establish remote port forwarding to temporarily expose internal resources in a controlled manner to authorized external entities when necessary.
• Understand the technical underpinnings of SSH tunnels and how encryption wraps protocols in a secured isolated channel.
• Install and configure key-based SSH authentication for establishing robust foundations before tunneling traffic.
• Explored vulnerabilities ranging from brute force attacks to side-channel timing analysis that undermine seemingly safe tunnels.
• Learned best practices like SSH certificates, restricted accounts, key-only authentication methods, dual factor verification, and more for hardening environments.

SSH tunnels provide immense utility bridging networks and bypassing filters when configured properly. But always keep in mind that a tunnel is only as strong as the SSH server backbone enabling it.

Now you know dozens of ways to leverage SSH port forwarding for remote access, restricted network traversals, exiting private subnets securely, prototyping socket entities, and much more. The power is at your fingertips!

Let me know in the comments about any other SSH tunneling applications and use cases you‘ve found valuable in your own environment. And follow me for more Linux security and encryption guides using a full-stack developer expert perspective!