SSH tunnel using a jump host

Access a service on a remote machine via an intermediary

ssh -v -L 4444:app.example.com:5000 $USER@jump.example.com -nNT

Now you can access the service running on app.example.com:5000 by going to localhost:4444 in your browser.

Explanation of the command

• from the host machine (where you are running the command)
• connect to jump.example.com as user $USER
• once there, access service app.example.com on port 5000
• then make that service available on the host machine on port 4444

Advanced usage - Two jumps

ssh -J user@jump.example.com user@app.example.com -L 1111:database.example.com:3306 -nNT -vvv

Notes:

-J jumps to another host

-L makes a tunnel to a service that's already running

Now you can do:

mysql --protocol=tcp --host=127.0.0.1 --port=1111

Notes:

- you must specify protocol because of the tunnel

- specifying 127.0.0.1 (instead of "localhost") prevents MySQL trying to use a local socket and failing

Use a proxy on a remote machine via an intermediary

If there's a proxy you need to use: proxy.example.com:8888 -- but you can only access it from jump.example.com -- then set up a tunnel like this:

ssh -A -L 4444:proxy.example.com:8888 $USER@jump.example.com -nNTv

Now you can use http://localhost:4444 as your proxy server, instead of http://proxy.example.com:8888

SSH tunnel

ssh -N -R 5555:1.2.3.4:666 user@hostname

• 5555 is a port you make up
• 666 is the port to which you are forwarding
• 1.2.3.4 is the IP of the target host to which you are fowarding
• hostname is the host where port 5555 will be made available
• you run this command on a third machine (e.g. your local host)

This results in  hostname:5555  getting forwarded to  1.2.3.4:666

SSH port forwarding / tunnelling

Command for a tunnel:

ssh -D 9999 username@remote-host

• -D means "dynamic application-level port forwarding"
• 9999 is a port you make up
• username@remote-host is the account you're relaying through
• A prompt on the remote host will appear, ignore it (or use -N to avoid)

In your web browser, set the SOCKS5 proxy to localhost:9999