From: "Neal P. Murphy" <neal.p.murphy@alum.wpi.edu>
Cc: netfilter@vger.kernel.org
Subject: Re: ssh tunnels and iptables
Date: Sun, 29 Jan 2017 19:54:37 -0500 [thread overview]
Message-ID: <20170129195437.2533b527@playground> (raw)
In-Reply-To: <CAGU6BD=-W-YwLXbYgNgCOwd-nO1RGK=0=GOEUauK00u+rEiQDQ@mail.gmail.com>
On Mon, 30 Jan 2017 06:03:08 +0530
deva seetharam <deva.seetharam@gmail.com> wrote:
> sorry, it does not make sense because it is a reverse tunnel. that is,
> the server that is running the firewall gets the connection requests
> on that port (2222). i see that the port opens (can see it using nmap)
> up as soon as the tunnel is up. however, IPTABLES does not have that
> port open. that is what is confusing.
That's because the 'reverse' tunnel flows across the encrypted SSH connection. The server's firewall never sees the traffic; it only sees packets flowing across the existing connection.
When a program on the server connects to localhost:2222 (or to remotehost.com:2222), SSH itself listens on that socket and communicates with the SSH instance running on the laptop to connect to the host:port specified in the '-R' option. The traffic for that connection flows across (is tunneled through) the encrypted SSH connection.
prev parent reply other threads:[~2017-01-30 0:54 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-01-29 15:27 ssh tunnels and iptables deva seetharam
2017-01-29 17:05 ` Mark Coetser
2017-01-30 0:33 ` deva seetharam
2017-01-30 0:54 ` Neal P. Murphy [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170129195437.2533b527@playground \
--to=neal.p.murphy@alum.wpi.edu \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.