|
ssh is a versatile tool that can not only remote login, you can also set up socks proxy performed within the network penetration, which is the use of its port forwarding function to achieve.
The so-called ssh port forwarding is based on the ssh connection, or specify a port ssh client ssh server as the source address, all data sent to the port packet will be forwarded via ssh connection; as for forwarding destination address, either specified or not specified, if you specify the destination address, called directional forwarding, if you do not specify the destination address is known as dynamic forwarding:
Directional Forwarding
directed to forward the packet is forwarded to the specified destination. The target address is not defined or ssh client ssh server, either one of the two, may be other than the two machines
Dynamic forwarding
dynamic forwards do not specify the destination address, packet forwarding destination is determined dynamically
Because ssh port forwarding is based on the ssh connection, so if ssh connection is lost, then port forwarding will also set a good stop.
Before setting up port forwarding, port forwarding must be confirmed ssh is open.
How to open the ssh port forwarding?
ssh port forwarding function is enabled by default. It's called a control switch AllowTcpForwarding, located ssh server configuration file / etc / ssh / sshd_config Lane:
AllowTcpForwarding yes
If you change, then you need to restart sshd service to take effect.
How to set up port forwarding?
Before setting up port forwarding to note iptables set up to ensure the appropriate port unmasked, if troublesome, then you can temporarily disable iptables:
# service iptables stop
directional forwarding and dynamic forwarding setting method is different, the following were introduced.
Directional Forwarding settings
You can put a directional forwarding IP: Port mapping directed to another IP: Port, the source and destination must be specified. The source address can be either a port ssh client and ssh server can also be a port:
If the source address is a port ssh client, called local forwarding (Local Port Forwarding), sent to the designated port ssh client data packet will be forwarded through ssh server;
If the source address is ssh server a port, it is called Remote Forwarding (Remote Port Forwarding), sent to the specified port ssh server through ssh client data packet will be forwarded.
Local forwarding settings:
look at the basic commands:
on the ssh client to perform:
{ssh client} # ssh -g -N -f -o ServerAliveInterval = 60
-L < local port >: < remote host >: < remote port > username @ < ssh server > meaning
parameters later explained.
We have the following diagram as an example: You want to telnet connection {remote host}, but can not direct, you can connect directly ssh client, so trying {ssh client} to {ssh server} This channel relay:
{you} - {ssh client} - {ssh server} - {remote host}
We need to do is {ssh client} executing the following command:
{ssh client} # ssh -g -L 2323: < remote-host >: 23 username @ < ssh-server >
After you enter a password, just like a normal ssh login, we entered the shell, the shell can be normal operation, the difference is that, while it also {ssh client} maps port 2323 to the {remote host} 23 port - - that is telnet port, then execute telnet < ssh client > 2323 ″ equivalent telnet < remote-host > , as long as the shell does not exit, this directional forwarding has been effective.
Note 1: If the above command does not add -g option, the listening port on the SSH Client 2323 binds on 127.0.0.1, meaning that only SSH Client themselves can connect to. Plus -g after option, SSH Client before allowing other machines on the network connection port 2323.
Note 2: The above command generates a shell, and sometimes does not meet our needs, because most of the time we just want a port forwarding function, linked to a shell is a burden, and a shell exit port forwarding stopped. That is why we need to -N -f option reasons:
-N tells ssh client, the connection does not need to execute any command, only to do port forwarding
-f tells ssh client running in the background
Note 3: In order to avoid long idle cause ssh connection is broken, we can add -o ServerAliveInterval = 60 ″ option, every 60 seconds to send a heartbeat signal to the ssh server. There is a role TCPKeepAlive option is similar, but not as good ServerAliveInterval because TCPKeepAlive work in TCP layer sends an empty TCP ACK packet, the firewall may be discarded; and ServerAliveInterval in SSH layer, transmitting real data packet, more reliable.
If it is not set up port forwarding as root, then port forwarding can only use ports greater than 1024.
Setting the remote forwarding:
look at the basic commands, divided into two parts:
On the ssh server:
edit / etc / ssh / sshd_config, set the following and then restart sshd service
GatewayPorts yes
on the ssh client to perform:
{ssh client} # ssh -f -N -o ServerAliveInterval = 60
-R < ssh server port >: < remote host >: < remote port > username @ < ssh server >
The examples shown below, you want to use telnet connection {remote host}, but can not direct, so trying {ssh server} to {ssh client} this channel transfer, and pay attention to local forwarded previously described the difference is that the local forwarding cases you can only connect directly to the ssh client, and here you can connect directly to the ssh server:
{you} - {ssh server} - {ssh client} - {remote host}
We need to do is {ssh client} executing the following command:
{ssh client} # ssh -f -N -R 2323: < remote-host >: 23 username @ < ssh-server >
to enter a password after, {ssh server} map 2323 port to {remote host} port 23 - - that is telnet port, then execute telnet < ssh server > 2323 ″ equivalent telnet < remote-host > .
Local forwarding and remote forwarding distinction and application scenarios
oriented forwards (including local and remote forwarding forwards) are typically used within the network penetration, local forwarding and remote forwarding difference is that listening ports are open on the ssh ssh client or the server. Common usage scenarios are:
If ssh client intranet inside, ssh server on the Internet, you want the machine on the Internet through the network into being, then use the remote forwarding;
If ssh server inside the intranet, ssh client on the outside, you want to wear into the network should use local forwarding.
Set up dynamic forwarding
oriented forwards (including local and remote forwarding forwarding) limitation is that you must specify a target address, if we need to use an intermediate server access address many goals, one by one way directional forwarding is obviously not good, then we use the ssh dynamic port forwarding, which is equivalent to the establishment of a SOCKS server.
look at the basic commands:
on the ssh client to perform:
{ssh client} # ssh -f -N -o ServerAliveInterval = 60
-D < ssh client port > username @ < ssh server >
There are two common practical use scenarios:
You put your own machine (127.0.0.1) as sock5 proxy server:
{you / ssh client} - {ssh server} - {other hosts}
command is as follows:
{ssh client} # ssh -f -N -D 1080 username @ < ssh-server >
In this case, we get socks5 proxy server are: 127.0.0.1: 1080, ssh client only for their own use.
Then you can support other software socks5 proxy settings or in the browser.
ssh client and ssh server are the same machine, and acts as a proxy socks5:
{you} - {ssh client / ssh server} - {other hosts}
command is as follows:
{ssh client} # ssh -f -N -g -D 1080 username@127.0.0.1
In this case, we get socks5 proxy server are:
{ssh client IP}: 1080, for use other machines on the network, as long as the connection ssh client can be.
established by SSH SOCKS server using the SOCKS5 protocol, SOCKS proxy settings for the application's time to pay attention. |