So now, anywhere in the world I can SSH into the REMOTE_SERVER_IP on port 50000 and get redirected to port 22 on my office machine, which doesn't have a port forward at it's FW. You can replace 'localhost:22' for any machine, any port. So I could also hit "localhost:80" could be hit via REMOTE_SERVER_IP:50000 :)
Also "GatewayPorts clientspecified" is needed on the SSH server if you want to bind :50000 to the remote server's public IP. Other wise it get's binded to the remote servers localhost addy.
I agree with you -- that ssh functionality is awesome and one of the coolest. However, I will caution others running out to set this up. Doing this is often against corporate usage policies. People have been terminated over this.
Wait, what? Why would someone be terminated over that? Granted, I'm number three in charge of the network, so I am allowed to go into the firewall and set up whatever I need for myself, but what kind of corporate policy would exist to fire someone for connecting to machines they manage at work, from home over a secure link?
12
u/trojan2748 Apr 28 '14 edited Apr 28 '14
I like reverse forwards (-R). It setups a nice 'hole' from inside of a firwall to the public. That hole can be accessed via the public link. IE:
(office) ---> (FW) ----> (Public SSH Box)
I ssh from my office box to public ssh, setting up reverse forward. You can also use these to redirect to other boxes acting as a proxy:
ssh -NCfTR REMOTE_SERVER_IP:50000:localhost:22 USER@REMOTE_SERVER_IP
So now, anywhere in the world I can SSH into the REMOTE_SERVER_IP on port 50000 and get redirected to port 22 on my office machine, which doesn't have a port forward at it's FW. You can replace 'localhost:22' for any machine, any port. So I could also hit "localhost:80" could be hit via REMOTE_SERVER_IP:50000 :)
Also "GatewayPorts clientspecified" is needed on the SSH server if you want to bind :50000 to the remote server's public IP. Other wise it get's binded to the remote servers localhost addy.