How can I use SSH to tunnel to a port that's open on the machine I have access to but not open to the outside world?

Question

I currently use SSH to tunnel my internet connection, using ssh -p <port> -ND <local port> <user>@<ip address>, and this works great. However, I'd like to bind a local port to a port that's open on the computer I'm SSHing to, but not open to the outside world, so that I can connect to the service on the machine I'm SSHing to on my local machine by references a port (say, 1234) like localhost:1234, instead of, say, remotehost:5678 (which will not work in my situation because of firewall issues).

Answer 1

You need to use the Bind Address option of ssh:

 -L [bind_address:]port:host:hostport
         Specifies that the given port on the local (client) host
         is to be forwarded to the given host and port on the
         remote side.  This works by allocating a socket to lis‐
         ten to port on the local side, optionally bound to the
         specified bind_address.  Whenever a connection is made
         to this port, the connection is forwarded over the
         secure channel, and a connection is made to host port
         hostport from the remote machine.  Port forwardings can
         also be specified in the configuration file.  IPv6
         addresses can be specified by enclosing the address in
         square brackets.  Only the superuser can forward privi‐
         leged ports.  By default, the local port is bound in
         accordance with the GatewayPorts setting.  However, an
         explicit bind_address may be used to bind the connection
         to a specific address.  The bind_address of “localhost”
         indicates that the listening port be bound for local use
         only, while an empty address or ‘*’ indicates that the
         port should be available from all interfaces.

So, for example, to bind local port 1234 to port 6667 of the remote server server.example.com, you would do something like this:

ssh -f -L 1234:localhost:6667 server.example.com 

Answer 2

assuming the ssh host is publicly accessible, you probably want to look into Port Knocking Heres one way to apply it to SSH: http://www.marksanborn.net/linux/add-port-knocking-to-ssh-for-extra-security/

Answer 3

take a look here: http://dzervas.gr/notes/ssh-tunnel/ It actually create a socks local proxy where all data is passed are sent to the sshed machine, on any port.

Answer 4

Your question is a little strange, because are you asking How do you set the remote computer up to only take access from your source computer, with ssh?

Or are you asking how do you set it up to restrict access to only allow your computer, with anything, and then connect to it with ssh.

Or are you saying it's already set up like that, how do you now connect with SSH.

Anyhow,

Look at this thread here it mentions a few ways to restrict access, it mentions doing so with SSH or with iptables(a firewall), and if you then want to then connect with SSH, that's just normal.

Why not add in your /etc/host.allow: sshd: IPADDRESS, IPADRRESS

or

Something like this in /etc/ssh/sshd_config perhaps? AllowUsers andy@192.168.1.*,1.2.3.4,5.6.7.8

billy@192.168.1.* charlie@192.168.1.*

this

The AllowUsers option for sshd_config is the easiest

route if you know who the users are. Alternatively,

there is the equally easy tcp_wrappers way

(/etc/hosts.allow and /etc/hosts.deny).

or

Probably easier to setup a firewall rule something like iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 --source [accepted ip address here] -j ACCEPT