<story><title>A Visual Guide to SSH Tunnels: Local and Remote Port Forwarding</title><url>https://iximiuz.com/en/posts/ssh-tunnels/</url></story><parent_chain></parent_chain><comment><author>jkingsman</author><text>At a former company, we needed to connect to customer&amp;#x27;s databases from our service. Many were understandably cagey about opening a public hole in their firewall to their DB, even if it&amp;#x27;s just for our single egress IP.&lt;p&gt;Our solution was to run a public host (the Reverse Bastion) that would, upon user request, generate a shell-less linux account for the user and install their public key. The user was then given an SSH command to run from inside their corp network that would connect to Reverse Bastion and establish a reverse tunnel pointing at their database. That way we could &amp;quot;connect&amp;quot; to that user&amp;#x27;s dedicated port on the Reverse Bastion and our traffic would traverse the tunnel and pop out inside their network, bound for their database. Since it&amp;#x27;s all TCP tunneling, JDBC drivers had no idea they were hopscotching around networks and did DB queries like usual. As long as you have the user accounts totally locked down and people&amp;#x27;s port assignments locked to their users via iptables, it was a walled (tunneled?) garden.</text></comment>
<story><title>A Visual Guide to SSH Tunnels: Local and Remote Port Forwarding</title><url>https://iximiuz.com/en/posts/ssh-tunnels/</url></story><parent_chain></parent_chain><comment><author>RpFLCL</author><text>This is a handy resource, SSH tunnels are something that I always find easier to grasp when displayed visually.&lt;p&gt;I use a reverse SSH tunnel to access my home network when traveling.&lt;p&gt;Ex:&lt;p&gt;- [Machine-A (on my LAN, behind NAT, with a dynamic IP address)] maintains a long lived SSH connection to [Machine-B (a VPS with a public IP)] with a reverse tunnel configuration.&lt;p&gt;- I can then SSH into Machine-B and follow the tunnel back into Machine-A, and from there access the rest of my home network.&lt;p&gt;It works pretty well. I can access files on my NAS and check on my Raspberry Pi cameras without needing to put either on &amp;quot;the cloud&amp;quot;. Although I have to admit I always have to pull up a resource like the one in OP whenever I want to setup something like this, I&amp;#x27;ve never learned it by heart and always need a refresher.</text></comment>