> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/pivoting-port-forwarding/ssh-tunneling/local-port-forwarding.md).

# Local Port Forwarding

SSH Local Port Forwarding enables the **attacker** (i.e., the **local machine**) to securely access a **remote internal service** by tunneling traffic through an intermediary machine — the **SSH client (or jump box)** — to which SSH access is available.

***

### 🧠 **Scenario Overview**

| Role                          | IP Address         | Description                                          |
| ----------------------------- | ------------------ | ---------------------------------------------------- |
| 🧑‍💻 **Attacker**            | `Attacker Machine` | Your local system initiating the SSH tunnel          |
| 🖥️ **SSH Client / Jump Box** | `192.168.1.10`     | A remote machine you can SSH into                    |
| 🎯 **Target Machine**         | `10.0.0.100:80`    | Internal service only accessible from the SSH client |

***

### 🎯 **Objective**

You want to access the **target web service** (`10.0.0.100:80`) from the **attacker machine**, even though you **do not have direct access** to it. The service is only reachable from the **jump box** (`192.168.1.10`).

***

### **Command Syntax (run on the *****Attacker*****)**

```bash
ssh -N -L [local_port]:[target_ip]:[target_port] [user]@[jump_box_ip]
```

***

### **Parameters Explained**

| Parameter          | Where It's Used         | Purpose                                                                |
| ------------------ | ----------------------- | ---------------------------------------------------------------------- |
| `ssh`              | **Attacker**            | SSH client used to initiate the connection                             |
| `-N`               | **Attacker**            | No remote command is executed (just forwarding)                        |
| `-L`               | **Attacker**            | Enables local port forwarding                                          |
| `local_port`       | **Attacker**            | Port to bind locally on the attacker's machine                         |
| `target_ip`        | **Jump Box Access**     | The internal target the jump box can access (e.g., `10.0.0.100`)       |
| `target_port`      | **Jump Box Access**     | The service port on the target (e.g., `80` for HTTP)                   |
| `user@jump_box_ip` | **Attacker → Jump Box** | SSH credentials to connect to the jump box (e.g., `user@192.168.1.10`) |

***

### **Example**

Let’s assume:

* **Attacker machine**: You
* **SSH client (jump box)**: `192.168.1.10`
* **Target web server**: `10.0.0.100:80`

#### Run this command **on the attacker machine**:

```bash
ssh -N -L 8080:10.0.0.100:80 user@192.168.1.10
```

#### What happens:

* Opens **port `8080`** on your **local attacker machine**
* Tunnels traffic through the **SSH client (`192.168.1.10`)**
* Forwards to the **target (`10.0.0.100:80`)**
* You can now visit:\
  `http://localhost:8080`\
  ...and it will securely tunnel to the internal web server

***

### **Limitations**

* You **must have SSH access** to the jump box
* The **jump box must be able to reach** the target machine
* The port bound locally (`8080`) is only accessible from your machine (unless explicitly bound to `0.0.0.0`)