> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/lat-mov/port-forwarding/port-forwarding-with-ssh.md).
# Port Forwarding with ssh
{% hint style="info" %}
WARNING
SSH port forwarding **requires** that you run the command **from a TTY shell!**
{% endhint %}
## Dynamic Port Forwarding
{% hint style="info" %}
NOTE
With dynamic port forwarding the listening port will be opened on the **SSH client side**.
{% endhint %}
Dynamic port forwarding are done with the syntax:
```
-D [bind_address:]port
```
This specifies a local “dynamic” application-level port forwarding. This works by allocating a socket to listen to port on the local side, optionally bound to the specified *bind\_address*. Whenever a connection is made to this port, the connection is forwarded over the secure channel, and the application protocol is then used to determine where to connect to from the remote machine.
Currently the SOCKS4 and SOCKS5 protocols are supported, and ssh will act as a SOCKS server. Only root can forward privileged ports. Dynamic port forwardings can also be specified in the configuration file.
### Proxychains
The proxychains configuration file is `/etc/proxychains4.conf`. A sample configuration is
```
socks5 127.0.0.1 9999
```
### Examples of Dynamic Port Forwarding
To create a dynamic port forwarding listening on all interfaces on port 9999. We'll also pass the **-N** flag to prevent a shell from being spawned.
```bash
ssh -N -D 0.0.0.0:9999 database_admin@10.4.50.215
```
## Local Port Forwarding
{% hint style="info" %}
NOTE
With local port forwarding the listening port will be opened on the **SSH client side**.
{% endhint %}
Local port forwarding can done with the following syntaxes:
```
-L [bind_address:]port:host:hostport
-L [bind_address:]port:remote_socket
-L local_socket:host:hostport
-L local_socket:remote_socket
```
This specifies that connections to the given TCP port or Unix socket on the local (client) host are to be forwarded to the given host and port, or Unix socket, on the remote side. This works by allocating a socket to listen to either a TCP port on the local side, optionally bound to the specified *bind\_address*, or to a Unix socket. Whenever a connection is made to the local port or socket, the connection is forwarded over the secure channel, and a connection is made to either host port *hostport*, or the Unix socket *remote\_socket*, from the remote machine.
### Examples of Local Port Forwarding
To create a local port forwarder (`-L`) from local port 1234 to port 5432 on the local machine without a shell (`-N`). That is `localhost:1234` is forwarded to `10.11.12.13:5432`.
```bash
ssh -L 1234:localhost:5432 -N christine@10.11.12.13
```
## Remote Port Forwarding
{% hint style="info" %}
NOTE
With remote port forwarding the listening port will be opened on the **SSH server side**.
{% endhint %}
Remote port forwarding can done with the following syntaxes:
```
-R [bind_address:]port:host:hostport
-R [bind_address:]port:local_socket
-R remote_socket:host:hostport
-R remote_socket:local_socket
```
This specifies that connections to the given TCP port or Unix socket on the remote (server) host are to be forwarded to the local side.
### Examples of Remote Port Forwarding
To create a remote port forwarder at our Kali machine on port 2345 and forward traffic to port 5432 on IP `10.4.50.215`. The `-N` parameter will prevent a shell being spawned.
```bash
ssh -N -R 127.0.0.1:2345:10.4.50.215:5432 kali@192.168.118.4
```
## Remote Dynamic Port Forwarding
{% hint style="info" %}
NOTE
With remote port forwarding the listening port will be opened on the **SSH server side**.
{% endhint %}
Remote dynamic port forwarding can done with the following syntaxes:
```
-R [bind_address:]port
```
Remote dynamic port forwarding uses the same **-R** option as classic remote port forwarding. The difference is that when we want to create a remote dynamic port forward, we pass only one socket: the socket we want to listen on the SSH server.
### Proxychains
The proxychains configuration file is `/etc/proxychains4.conf`. A sample configuration is
```
socks5 127.0.0.1 9998
```
### Examples of Remote Dynamic Port Forwarding
To create a remote dynamic port forwarder at our Kali machine on port 9998 and forward traffic to SSH client's host. The `-N` parameter will prevent a shell being spawned.
```bash
ssh -N -R 9998 kali@192.168.118.4
```
## Usage information
ssh -h
```bash
┌──(kali㉿kali)-[~]
└─$ ssh --help
unknown option -- -
usage: ssh [-46AaCfGgKkMNnqsTtVvXxYy] [-B bind_interface] [-b bind_address]
[-c cipher_spec] [-D [bind_address:]port] [-E log_file]
[-e escape_char] [-F configfile] [-I pkcs11] [-i identity_file]
[-J destination] [-L address] [-l login_name] [-m mac_spec]
[-O ctl_cmd] [-o option] [-P tag] [-p port] [-R address]
[-S ctl_path] [-W host:port] [-w local_tun[:remote_tun]]
destination [command [argument ...]]
ssh [-Q query_option]
```
## Resources
proxychains-ng - GitHub:
proxychains-ng - Kali Tools:
Secure Shell - Wikipedia:
ssh - Linux manual page:
SSH Cheat Sheet - pentestmonkey:
SSH Tunneling Examples - SSH Academy: