Lion Cipher Lab
SSH tunneling and port forwarding: reach a service that isn't directly reachable
- Foundations
- Intermediate
- ~40 min
- Free · no account required
Why it matters
Sooner or later a service you need isn't directly reachable — a database that only listens on localhost, an admin panel bound to an internal network, a dashboard on a machine buried behind a jump host. The lazy fix is to expose it to the world and hope. The right fix is often already in your hands: SSH can carry another connection inside the encrypted session you already trust. That is a tunnel, and port forwarding is how you steer it. Learn the three shapes — pull a remote service down to a local port (-L), push a local service out to a remote port (-R), or turn one SSH session into a…
What you'll learn
- SSH port forwarding
- local forwarding (-L)
- remote forwarding (-R)
- dynamic forwarding / SOCKS proxy (-D)
- reading ssh_config (LocalForward/RemoteForward/DynamicForward/ProxyJump)
- recognizing reverse-tunnel pivoting defensively
- choosing a tunnel vs a VPN or reverse proxy
Steps in this lab
- What a tunnel is, in one breath
- Set up a local SSH endpoint you control
- Stand up a throwaway service to reach
- Local forwarding (-L): pull a remote service down to a local port
- Remote forwarding (-R): push a local service out to the remote side
- Why the reverse tunnel is also an attacker's favorite — watch for it
- Dynamic forwarding (-D): one SSH session as a SOCKS proxy
- Handy flags and putting forwards in ssh_config
- When a tunnel is the right tool — and when it isn't