alt.hn

6/20/2026 at 3:55:19 AM

A Practical Guide to SSH Tunnels: Local and Remote Port Forwarding

 https://labs.iximiuz.com/tutorials/ssh-tunnels

by signa11

6/24/2026 at 4:27:17 PM

My favorite use of this is peer-to-peer transfer of Docker images. The Docker CLI only allows you to use registries authenticated with HTTPS but there's an exception where it allows HTTP transfers over localhost.

So, if you use SSH tunneling to forward a port from localhost to a remote, then Docker unwittingly pushes to a remote. This is super useful "off the grid" with robotics/embedded applications where you don't want to bother with a registry and a good Internet connection.

Example, docker pussh: https://github.com/psviderski/unregistry

by tangotaylor

6/24/2026 at 6:11:18 PM

That's not quite true, you just need to add the `insecure-registries`[1] option with a list of either IP (or ip ranges) or hostnames that you want to allow without TLS.

```/etc/docker/daemon.json

  {
    "insecure-registries": ["10.100.0.0/24", "registry.yourmom.example.com:5000"]
  }
```

[1] https://docs.docker.com/reference/cli/dockerd/#insecure-regi...

by mmh0000

6/24/2026 at 7:29:45 PM

Yes this is true. I should caveat that we distributed the tool among a team and we didn't want to ask them to all edit their daemon.json with an ever-expanding list of IP addresses.

by tangotaylor

6/24/2026 at 5:50:04 PM

This is really useful as you don't have to add an entry under insecure-registries for local registries that don't have valid certificates.

by QGQBGdeZREunxLe

6/24/2026 at 5:53:03 PM

You might as well handover the images to hackers.

by bitlad

6/24/2026 at 4:57:52 PM

iirc there's a setting to allow docker to trust and use http registries

i set it up a few years ago for my homelab

by Kampfschnitzel

6/24/2026 at 6:30:00 PM

Which makes me think that I have never heard of signed images/artefacts

by afiori

6/24/2026 at 2:17:50 PM

I'll mention it here, because I learned about it here.

"~C" will drop you into the SSH command line, allowing you to, among other things, effect port forwarding

  -L8080:localhost:443
Learning that "~C" exists, and what you can do with it, has supercharged my use of SSH tunnels, which were already awesome on their own.

But for some reason this has been disabled by default in more recent ssh configurations... to ensure its available

  -o EnableEscapeCommandline=yes
or, in your ~/.ssh/config

  EnableEscapeCommandline yes
(edit: formatting)

by buredoranna

6/24/2026 at 2:31:37 PM

Important to note that `~` SSH commands work only right after you press Enter - it doesn’t trigger everywhere you press `~`.

Also EnableEscapeCommandline fortunately only affects `~C` - the all-important `~.` to kill a hung SSH session still works with it disabled.

by telotortium

6/24/2026 at 4:05:08 PM

so many time i have inadvertently ended a session with a fat fingered ~.

by ptaffs

6/24/2026 at 3:09:35 PM

I never pass up an opportunity to recommend the Cyber Plumber's Handbook: https://github.com/opsdisk/the_cyber_plumbers_handbook

Goes over similar content as TFA, in perhaps a little more depth. Indispensable sysadmin knowledge.

by wbadart

6/24/2026 at 3:42:05 PM

Appreciate the mention wbadart!

by opsdisk

6/24/2026 at 4:26:16 PM

Not mentioning the ssh -w option in that book should be a crime.

by ranger_danger

6/24/2026 at 3:52:24 PM

so good, I learn new things.

by susu1111

6/24/2026 at 3:51:10 PM

Need to mention sshuttle [0] here, as it magically solves a bunch of these problems without constant reconfiguration

[0] https://github.com/sshuttle/sshuttle

by smw

6/24/2026 at 6:58:35 PM

sshuttle is amazing. I've used it extensively on stupidly configured networks, super useful tool.

by mystifyingpoi

6/24/2026 at 1:46:56 PM

The article mentions bastions, but no jumphosting?

  ssh -J user1@bastion1,user2@bastion2 targetuser@targethost
Edit: Jumphosting was introduced in OpenSSH 7.3 2016-08-01.

https://www.openssh.org/releasenotes.html

by chasil

6/24/2026 at 2:11:10 PM

It is surprising how many times I see this content (this version might be marked “Published: Jun 19, 2026” but I've definitely seen those exact diagrams before, starting at least a few years ago, and the same content around them in many tutorials before that) without it being updated to mention jump-hosts.

Support was added to OpenSSH about a decade ago? Even on a low moving Linux distro like Debian/LTS everyone should have support by now.

by dspillett

6/24/2026 at 6:42:24 PM

For me, this is always used via ProxyJump rules in my ~/.ssh/config

It is also nice that it works recursively, so I can logically structure my rules so that the one for my regular targets say to use bastion1, then the rule for bastion1 says to go via bastion 2, etc.

I find this easier to reason about and maintain rather than juggling a bunch of these multi-step rules.

by saltcured

6/24/2026 at 5:50:14 PM

>ssh -J user1@bastion1,user2@bastion2 targetuser@targethost

Are you using SSH key auth or password authenticating three times when you do this?

by m348e912

6/24/2026 at 6:36:02 PM

If you don't have an agent running with an accessible key, then you will get three password prompts, with suggestions for any default keys.

The final target is a pre-elliptic curve OpenSSH server, so legacy is enabled. I could probably have removed that for clarity.

  C:\Users\me\>ssh -J me@bhost1,me@bhost2 -o KexAlgorithms=diffie-hellman-group14-sha1 -o HostKeyAlgorithms=ssh-rsa -o MACs=hmac-sha1 oracle@target
  Enter passphrase for key 'C:\Users\me/.ssh/id_ed25519':
  me@host1's password:
  Enter passphrase for key 'C:\Users\me/.ssh/id_ed25519':
  me@host2's password:
  oracle@target's password:
  Last login: Wed Jun 24 13:29:55 2026 from bhost2
That client is Microsoft's port of OpenSSH.

by chasil

6/24/2026 at 6:44:03 PM

I always use keys in my SSH agent.

Because the jump mechanism works via use of TCP forwarding, each host authn step is talking "directly" to your client. Importantly, this means it still works without requiring "agent forwarding" for the connection you are making.

by saltcured

6/24/2026 at 6:40:49 PM

Thanks! I will keep this for reference. I use ssh alot but thie reminds me that I can learn new ways of tunneling :-)

by phbeks

6/24/2026 at 2:08:09 PM

Learning how SSH port forwarding is great as a pseudo-vpn for everything from GUI-client database access to (in physical infra) access to web-admin tools for appliances.

The socks proxy support can also deal with bad web filtering and privacy issues on public wifi networks (though nowadays if you're ssh'ing to a cloud IP, you'll get lots of "bot" restrictions).

by hylaride

6/24/2026 at 6:53:00 PM

Yeah, I get use out of the SOCKS proxy mode in combination with a "split VPN" at work.

I need VPN to get into some internal resources via SSH, but there are lots of external/public/AWS resources I also need to access, and the full VPN adds too much overhead and fragility for those.

Using the available split VPN, I can point a browser instance at a localhost SOCKS proxy port to relay over SSH + VPN for other web resources I need to access internally.

Unfortunately, Firefox proxy config rules are sort of backwards for my needs. I want to say "only use proxy for these 3 domains" whereas it wants to use the proxy by default and only allow me to bypass specific domains.

by saltcured

6/24/2026 at 7:30:00 PM

In the past, I've used plugins to do just what you ask. FoxyProxy Standard did the trick (it looks like there's now at least another more standard "VPN" version, too). It looks like Firefox does have support for Native PAC files that'll also do the trick: https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Pro...

by hylaride

6/24/2026 at 3:15:12 PM

If you have many different remote devices behind NATs or firewalls, a cool trick to access them all via EC2 server (or such) is to setup Remote Forwarding via UNIX socket on the server side, to devices' port 22. Preferably, UNIX socket filenames should start with a common prefix, so an SSH config can be written that will use ssh+socat in a ProxyCommand to establish the connection.

It's amazing how lightweight this method actually is. I have managed to connect hundreds of devices using a single EC2 nano instance.

by bheadmaster

6/24/2026 at 6:46:27 PM

I think the more modern ProxyJump rule is superior for this. Just let it manage the actual TCP forwarding for you automatically. It's just the normal "bastion host" concept.

Particularly, you can use name patterns to apply the same rule broadly, assuming you have some systematic naming scheme for your eventual target devices.

by saltcured

6/24/2026 at 4:51:11 PM

Do you have more info on this method? How is the remote forwarding actually done?

by ranger_danger

6/24/2026 at 5:24:55 PM

[dead]

by mldbk

6/24/2026 at 7:04:16 PM

Weird.. I have almost this exact same "cheat sheet" printed out and stuck up on my whiteboard.. except it's slightly different. Only 4 panels instead of 6 and the panels don't have titles.

I know this is a solid "cool story bro" moment, but whatever hah

by ktm5j

6/24/2026 at 1:33:59 PM

It’s amazing what you can learn by reading the manual.

by teddyh

6/24/2026 at 2:08:14 PM

It is, because manuals are often not the best way to learn things. Most software manuals are reference manuals. SSH man page isn't too bad. I learned most of my SSH knowledge from it, but I'm not sure it's the best way to do it.

by felooboolooomba

6/24/2026 at 2:58:14 PM

For me, the best way to learn a tool is for a quick example or two showing its utility, then practicing with those, reading the man as needed on specific flags. Google or bot ”how do x" ? Repeat : done

Some pages have a nice up-front synopsis of flags, others put them in a wall of text. Browsing the former can supplant Google, /\b-x while paging is helpful for the latter.

by matltc

6/24/2026 at 2:11:03 PM

Or you could just install something like Tailscale and never have to think about it again.

by segphault

6/24/2026 at 2:05:31 PM

As a sysadmin, one of your biggest ROI is learning the ins and outs of SSH.

by felooboolooomba

6/24/2026 at 1:50:19 PM

There's a asymmetry here that "-R" works both for reverse static and dynamic (using SOCKS protocol) forwarding, but "-D" is required for dynamic forwarding which "-L" cannot do.

Why is that?

by riobard

6/24/2026 at 3:23:24 PM

It's historical. Some older flags could be easily extended for dynamic port support and others could not.

by hylaride

6/24/2026 at 1:37:44 PM

When I see one of these with obvious AI tells at the top (sentences lacking a subject or verb), I ask myself:

Can’t I just open up a harness and prompt “Teach me how to do X?”

by trollbridge

6/24/2026 at 2:03:10 PM

I do this all the time, I have a skill/gem with instructions on how I want to receive info, how to format and so on. Really helps to go fast to get the point.

by lfx

6/24/2026 at 2:43:39 PM

Could you share it? I'd be interested to get idea to make my own

by Oxodao

6/24/2026 at 4:11:34 PM

It goes like this: --- As an expert tutorial creator for experienced engineers, you take the input the user request and make interactive tutorial. Default style is technology, tech is mac and linux. Default style is 20mins, but you ask for the timeline. Also do not forget to provide the cost of technologies used. ---

by lfx

6/24/2026 at 1:49:33 PM

I personally do this, ask claude code to teach me about concepts I don't know about when it codes something, and only then I accept what it suggests to me

by GL26

6/24/2026 at 3:24:41 PM

Should add how to bypass MFA using phishing and SSH Multiplexing to the article.

by Bender

6/24/2026 at 2:51:25 PM

Very refreshing to see a utilitarian series such as this. Disappointing that the latest ai drama gets 20x more discussion and visibility on this site

by matltc

6/24/2026 at 4:08:12 PM

Another option that I never see mentioned anywhere is -w which allows you to create either layer2 or layer3 tunnels via a tun(4) interface.

by ranger_danger