ssh的三种隧道转发

（1）本地端口转发

本地端口转发用法

    -L [bind_address:]port:host:hostport
    -L [bind_address:]port:remote_socket
    -L local_socket:host:hostport
    -L local_socket:remote_socket
             Specifies that connections to the given TCP port or Unix socket on the local (client) host are to be forwarded to
             the given host and port, or Unix socket, on the remote side.  This works by allocating a socket to listen to either
             a TCP port on the local side, optionally bound to the specified bind_address, or to a Unix socket.  Whenever a con‐
             nection is made to the local port or socket, the connection is forwarded over the secure channel, and a connection
             is made to either host port hostport, or the Unix socket remote_socket, from the remote machine.

             Port forwardings can also be specified in the configuration file.  Only the superuser can forward privileged ports.
             IPv6 addresses can be specified by enclosing the address in square brackets.

             By default, the local port is bound in accordance with the GatewayPorts setting.  However, an explicit bind_address
             may be used to bind the connection to a specific address.  The bind_address of “localhost” indicates that the lis‐
             tening port be bound for local use only, while an empty address or ‘*’ indicates that the port should be available
             from all interfaces.

本地端口转发示例

host1监听10086端口，会把该端口的请求通过ssh 隧道转发至host2，host2收到该请求后作为代理转发给后端的host3的80端口，host3将结果返回给host2，host2通过ssh隧道返回给host1结果。

 

（2）远程端口转发

远程端口转发用法

    -R [bind_address:]port:host:hostport
    -R [bind_address:]port:local_socket
    -R remote_socket:host:hostport
    -R remote_socket:local_socket
             Specifies that connections to the given TCP port or Unix socket on the remote (server) host are to be forwarded to
             the given host and port, or Unix socket, on the local side.  This works by allocating a socket to listen to either a
             TCP port or to a Unix socket on the remote side.  Whenever a connection is made to this port or Unix socket, the
             connection is forwarded over the secure channel, and a connection is made to either host port hostport, or
             local_socket, from the local machine.

             Port forwardings can also be specified in the configuration file.  Privileged ports can be forwarded only when log‐
             ging in as root on the remote machine.  IPv6 addresses can be specified by enclosing the address in square brackets.

             By default, TCP listening sockets on the server will be bound to the loopback interface only.  This may be overrid‐
             den by specifying a bind_address.  An empty bind_address, or the address ‘*’, indicates that the remote socket
             should listen on all interfaces.  Specifying a remote bind_address will only succeed if the server's GatewayPorts
             option is enabled (see sshd_config(5)).

             If the port argument is ‘0’, the listen port will be dynamically allocated on the server and reported to the client
             at run time.  When used together with -O forward the allocated port will be printed to the standard output.

注意点：远程端口转发模式下，远程端的/etc/ssh/sshd_config中的GatewayPorts需要置为yes，如下图所示

远程端口转发示例

host1监听10086端口，会把该端口的请求通过ssh 隧道转发至host2，host2收到该请求后作为代理转发给后端的host3的80端口，host3将结果返回给host2，host2通过ssh隧道返回给host1结果。

（3）动态端口转发（SOCK代理）

动态端口转发用法

-D [bind_address:]port
             Specifies a local “dynamic” application-level port forwarding.  This works by allocating a socket to listen to port
             on the local side, optionally bound to the specified bind_address.  Whenever a connection is made to this port, the
             connection is forwarded over the secure channel, and the application protocol is then used to determine where to
             connect to from the remote machine.  Currently the SOCKS4 and SOCKS5 protocols are supported, and ssh will act as a
             SOCKS server.  Only root can forward privileged ports.  Dynamic port forwardings can also be specified in the con‐
             figuration file.

             IPv6 addresses can be specified by enclosing the address in square brackets.  Only the superuser can forward privi‐
             leged ports.  By default, the local port is bound in accordance with the GatewayPorts setting.  However, an explicit
             bind_address may be used to bind the connection to a specific address.  The bind_address of “localhost” indicates
             that the listening port be bound for local use only, while an empty address or ‘*’ indicates that the port should be
             available from all interfaces.

动态端口转发示例

 

host1监听10086端口，当有SOCK连接到host1的10086端口时，host1转发给host2，host2作为代理将请求后的结果通过ssh隧道返回给host1。

 

（4）其他用到的命令选项释义

-f      Requests ssh to go to background just before command execution.  This is useful if ssh is going to ask for passwords
             or passphrases, but the user wants it in the background.  This implies -n.  The recommended way to start X11 pro‐
             grams at a remote site is with something like ssh -f host xterm.

-g      Allows remote hosts to connect to local forwarded ports.  If used on a multiplexed connection, then this option must
             be specified on the master process.

-N      Do not execute a remote command.  This is useful for just forwarding ports.